Based on the FortiGate Infrastructure 7.6 study guide and the Hardware Acceleration technical documentation, the diagnose vpn tunnel list command provides the status of IPsec tunnel offloading to the Network Processor (NPU).
In the provided exhibit, the specific value npu_flag=20 (which corresponds to 0x20 in hexadecimal) indicates that the IPsec Security Association (SA) cannot be offloaded to the NPU. While the NPU may have visibility of the gateway IPs (npu_rgwy and npu_lgwy), the flag itself serves as a diagnostic indicator that the traffic must be processed by the system CPU rather than the hardware accelerator.
This lack of offloading typically occurs when the tunnel configuration uses a cipher (encryption algorithm) or an HMAC (authentication algorithm) that is not supported by the specific NPU model installed in the FortiGate. For example, if a tunnel is configured with a legacy or highly complex algorithm that the NP6 or NP7 chip is not designed to process in hardware, the FortiOS kernel handles the encryption and decryption, resulting in the npu_flag=20 status. Therefore, despite the presence of NPU-related fields, the specific flag value confirms that hardware acceleration is not active for these SAs.

From the Root FortiGate - System Administrator Configuration exhibit:
The AdminSSO account has the super_admin_readonly role.
From the Downstream FortiGate - Security Fabric Settings exhibit:
The Security Fabric role is set to Join Existing Fabric, meaning it will authenticate with the root FortiGate.
SAML Single Sign-On (SSO) is enabled, and the default admin profile is set to super_admin_readonly.
When the AdminSSO user logs into the downstream FortiGate using SSO, the authentication request is sent to the root FortiGate, where AdminSSO has super_admin_readonly permissions.
Since the downstream FortiGate inherits this permission through the Security Fabric configuration, the user will be granted super_admin_readonly access.

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:
To deploy ADVPN (Auto-Discovery VPN) efficiently across an enterprise, Fortinet recommends centralized orchestration and standardized provisioning:
* VPN Manager (A): Within FortiManager, the VPN Manager is the primary tool for orchestrating complex VPN topologies. It allows administrators to define a Hub-and-Spoke community and enable ADVPN features (like shortcuts) globally across all participating devices from a single interface.
* IPsec templates (D): These templates (found under Provisioning Templates in FortiManager) allow administrators to define standard Phase 1 and Phase 2 settings once and apply them to multiple model devices or device groups. This ensures consistency across the enterprise and significantly reduces the manual configuration required for each spoke.

Prerun CLI templates used during ZTP or LTP are intended only for the initial bootstrap phase before the normal device configuration is installed. After the quick install completes, FortiManager automatically unassigns the prerun CLI template because its purpose has already been fulfilled.