A customer who has a multi-tenant environment needs the administrator to be restricted lo specific...

To restrict an administrator's access to specific objects and policies in the virtual system within a multi-tenant environment, you should:

A.Define access domains for virtual systems in the environment

Access domains allow you to control administrator access to specific virtual systems, device groups, and templates. By defining access domains, you can restrict the administrator's permissions to only the relevant sections of the configuration, ensuring they can manage only the objects and policies within their assigned virtual systems.

References:

Palo Alto Networks - Admin Role Profiles and Access Domains: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/administering-pan-os/admin-role-profiles-and-access-domains

Palo Alto Networks - Multi-Tenancy in Virtual Systems:https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/firewall-administration/multi-tenancy