restric manager certificate and grant authority

helloa
first thing i got request from of our managers
basically we manages the Certificate Root server, we have 3-4 
domains with same architecture, and we want to get control of 
who can manage certificate and whose not
i know that option to restrict with out the security tab configure
also on templates existing
please share with me some of the knowledge above
thanks