Sync Gateway handles users’s access control through channels; you can check the documentation here.
Couchbase Lite Database doesn’t handle access control so the application will need to implement the access control by itself. For your use case, you can either:
Naming the database or the directory to store the database differently based on the username.
Delete the user database when logging out or before logging in if this is suitable for the application use case.
I think I will create a soft tie between the WPF app’s SGW login and the windows user ac & install the app per user. Meaning the any new login will need a user ac on the win box, keeping any user data in tact & not having any surprises for the users.