@Watz Are you only using roles? no employee?

Yes, only filtering on roles in the audience for the script deployment. The theory we have is that since the workflow is running as admin, it passes that along to the workflow action script, and when it saves the record it triggers the UE-script but bypasses the audience filter.

The Action Script should have a deployment too I believe...

True

Check the action script deployment and see if you can change the executed as at the action script level.

I can, but why would I? The action script might need to be executed as admin for other reasons. We can circumvent this issue by checking the current role inside the script instead and do an early return if it is the excluded role.