Check the ACLs on that node in crx.If there's no deny ACL for the user that you want to deny, add one(such as deny on jcr:All), and then verify whether that user still sees the option to use custom workflow. The following doc may be helpful:https://docs.adobe.com/content/help/en/experience-manager-6...