The end user can right click on the tray application icon and enable privacy mode. It can have options to enable for a set time (30 60 90 min.) or indefinably. This mode would disable visual remote access entirely to the device while enabled. Some policies may be set to allow if user doesn't respond or auto allow and a user working on sensitive information may want to be sure that their screen can not be seen for a short time. I have had this request from HR and executives who normally want their systems accessible for support but during certain times want it restricted.