The same profile must issue from several CAs — prod/dev pairs, parallel classical/PQC hierarchies. Copy the template and you now maintain two documents that will drift one edit at a time. So don't copy: derive. A derived template's entire document is two fields:
derivedFrom: tls-server-pqc # the master issuerRef: ica-tls-dev # the only thing allowed to differ
It mirrors the master's latest version at resolution time — edit the master once, every derivation follows. Anything else in a derived document is rejected ("edit the master instead"), and derivation is one level deep by design: no inheritance chains, ever. When a derivation needs to start diverging, the console's Convert to standalone makes the divergence explicit and owned.
Known issue in the current build. Saving, resolving and the console semantics work — but the issuance path likely refuses every derived template: the RA reads the raw two-field document, cannot evaluate it, and refuses enrollment (build-gap register CA-011, found 2026-08-12). Until a release notes the fix, verify with a test enrollment before building a workflow on derived templates — and expect to use full copies in the meantime.
Now I can share one profile across CAs — and I know the current build's caveat before I depend on it.