SAS Studio tasks are not definable as metadata objects, so you can't set up authorization for these tasks using SAS Studio, SASMC or the Metadata Server. There is no user permission model built into SAS Studio to control access to tasks. As such, your only option is to control access to where you store the tasks. You can share tasks in segregated repositories or shared folders, and limit access to these repositories/folders using operating system permissions. You can read more about this here:
When I played with making a repository for use in SAS/Studio all I really had to do in SAS/Studio itself was put in the URL to the webserver that would surface the properly formatted XML files.
How does that link actually get used? Is there anyway that the webserver that is returning the result could know which user is asking for it? Could the URL be constructed to include the user's name as a parameter?
If so then the webserver could delivery metadata based on the users id (or group etc).