I had always thought once the WF logs the user out they are immediately under the ‘everyone else’ privacy rule.