Ah. Correct.
But, I still get the wrong record set.
The only way I can get it not to give me the wrong set of group records are to change it as so:

select rule.* from rule INNER JOIN users on rule.cuserid = users.cid where Users.cID = ?vp_cuserid ;
UNION all;
select rule.* from rule INNER JOIN users on rule.cgroupid = users.cgroupid where Users.cID = ?vp_cuserid and rule.cgroupid <> "ZZZZZZ"

But is this an incorrect way to try to accomplish this?