how to prevent unauthorized template creation

You sure can!
Indeed we don't have a template entity as a template is essentially a project that is marked as a template in our database.
To block a template creation you need to create a validation rule on the project level, event = a record is created.
In the eval criteria check that 'IsTriggeredBy('NewTemplate')=TRUE'
Here is where you can read more about this function:
http://usermanual.clarizen.com/#formula-editor-functions$IsTriggeredBy%20Function

To exclude admins add '&& not currentuser().admin'. Similarly for super users.

Roni

Roni,

This is very helpful. Thank you!

Bo