Hi Barton,
Authorization object S_RS_HIER is only checked when working with hierarchies in the BW backend (i.e. Data Warehousing workbench). It is not checked during BEx Query processing, assuming that you use a BEx Query as a DataSource in Analysis for Office.
I think that you will have to work with Analysis Authorizations (t/code RSECADMIN) to make appropriate Analysis Authorization objects for the various user groups to restrict hierarchy selection and processing. Prerequisite is to make Characteristic 0MATERIAL authorization-relevant.
You have to assign the relevant Analysis Authorization object to the user either directly (using t/code RSECADMIN) or via an Authorization Role (t/code PFCG).
Best regards,
Sander