Just checking on something before I start to make my deployment.

• hEX S specs say that PoE out is "Passive PoE up to 57V".
• wAP ac says that its PoE in is "802.3af/at".

Are these devices compatible (i.e., wAP ac can be powered via PoE from hEX S)? I would generally think not since this is passive PoE vs. active PoE, but it also seems like the kind of use case you would expect.

hEX S product page specifies passive PoE out of up to 57V. But won't regulate voltage, PoE out voltage is the same as power input, supplied power brick is 24V 1.2A.

wAP ac product page indeed says 802.3af/at PoE in, but also specifies PoE in voltage 11-57V. Knowing that 802.3af/at voltage starts at 40+V and is nominally 48V, one can guess that wAP ac also works as passive PoE PD. And indeed all of current Mikrotik devices that support PoE in are capable of passive PoE in, only select devices are capable of 802.3af/at PoE in.
Brochure for wAP ac (available from product page) indeed explains different powering options in a bit more detail:

PoE in Yes
Supported input voltage 11 V - 57 V (802.3af/at with shielding not connected to GND pins, passive PoE)

So in short: wAP ac will happily run off hEX S PoE out port.

Thanks for the reply. As I don't have the right power brick, I think I'll have to stick with the PoE injector.

Which products are "supposed" to work out of the box in this application? Seems common among most of the routers to have this kind of setup.

Something like the OmniTIK 5 ac, NetBox 5, or SXTsq 5 ac?

There are a few things one has to observe when using passive PoE:

1. power supply has to supply voltage that both (all) devices accept. For mikrotik devices 24V is pretty universal, but not all devices accept it. So one has to verify it.
2. power supply has to be rated for high enough output power (product of voltage and max current) to fully cover power usage of both (all) devices.
3. most of PoE out ports have limits of maximum current allowed. And some PoE in devices have a bit higher power consumption. One has to verify that current drawn by powered device does not exceed maximum allowed current on device providing power. RBGPOE passive injector has relatively high current limit (2A) which means sometimes it's the only way to power some devices
   Beware that many devices have different current limits when outputing low voltage (e.g. below 28V) and when outputing high voltage (e.g. above 40V).
4. if UTP calbe between power donor and power sink is longer than a few metres, consider that with higher power draw there will be voltage drop on the cable ... which in turn means even higher current drawn ... if the whole thingie is near the limit (e.g. device requires 11W, one is using 24V power adapter, PoE out port has limit of 500mA and UTP cable is long enough to cause 3V drop, this means that current drawn will actualy exceed those 500mA), it might spiral to non-working state. Specially so if power source specification doesn't allow any margin in power budget.
5. most Mikrotik devices support passive PoE in, only a few support true standard 802.3af/at PoE. Small number of Mikrotik devices support PoE out, even less support true standard 802.3af/at and only rare ones support more than one output voltage (i.e. mix of low votlage passive PoE on some ports and 802.3af/at high voltage on some other ports).

TL;DR: always tripple check power specifications of all involved devices to determine if intended PoE mix is possible or not.