Check out this posting on doing “record level security”… in there, I posted a solution for filtering out certain records based on a criteria. This is done with a BPM and the BPM simply removes the answers you do not want to see before they are presented to the user.