ITIL is the only role that grants access to read the contract_sla table. The way to figure it out is to click "System Diagnostics > Debug Security". The debug output will give you links to the related ACL's. You will need to create a new role that grants read privileges to the contract_sla table.
For templates it is a little more complicated. There are both role requirements and dynamic condition requirements (I am referring to Helsinki, this may vary for different versions). There are three separate ACLs, one for each type of template (user, group or global). Each one has a role and a condition. The three roles are template_editor (can manage only templates for themselves), template_editor_group (can manage their group's templates), template_editor_global (can manage global templates or their own templates).
To write to a global template for example, you must have template_editor_global and the template must be Global (or your own personal template).
