You can achieve this through mashup I think.
Let's look at the below code:
var app = qlik.openApp('Centers.qvf', config);
QV1 and QV2 are two separate objects in your mashup. You can show/hide these objects basis on your authorization matrix using ajax call. In mashup you can use jquery ajax call by just importing jquery reference.
To hide/show these objects, you can use below syntax of jQuery:
I think this is one way to resolve your issue.