Google Vault for specific organizational unit

[jeffr]

I need a way to limit a Google Vault admin's access to create and manage matters, holds, searches, and exports to a specific set of users or organizational unit. 

I created a custom admin role, but when I assign it I'm not able to choose which organizational unit the admin has access to. What am I missing?