Reference:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/nat/nat-configuration- examples/ destination-nat-exampleone-to-one-mapping.html#ide8f6a4b3-f875-4855-acb5-
5fd9ad918d04

You can use Templates and Template Stacks to define a wide array of settings but you can perform the following tasks only locally on each managed firewall:
Configure a device block list.
Clear logs.
Enable operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode.
Configure the IP addresses of firewalls in an HA pair.
Configure a master key and diagnostics.
Compare configuration files (Config Audit).
Renaming a vsys on a multi-vsys firewall.
https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/manage-firewalls/manage- templates-and-template-stacks/template-capabilities-and-exceptions

Device administrator (read-only)
Read-only access to all firewall settings except password profiles (no access) and administrator accounts (only the logged in account is visible).
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewall-administration/manage- firewall-administrators/administrative-role-types

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/decryption-licenses

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/user-id/map-ip-addresses-to- users.html#id61f141da-8b89-49c9-b34a-ed11b434d1db