Are you using wccp redirect? I think you would just need to make sure you're leaking the default route to any VRF you want to serve and making sure you can ping the websense IP address referenced on your router config from the source IP address of the firewall used in your websense config. To my knowledge, there is no restriction here. I know WAAS doesn't work in a multi-VRF scenario, you need one WAAS per VRF, but I don't think a similar restriction applies with Websense.