Is it possible to make a user group that can read and write certain things only? If I give someone a router that I can control, I want them to be able to add dst-nat rules so they can port forward without needing to contact someone. However, I don’t want them to be able to do anything else. I saw that you can specify a WebFig skin so maybe this can hide everything except for the NAT rule table.
[SOLVED] Your answer is inside your question
But you can not lock the “masquerade” route, if the client delete or modify it…
Simply enable UPnP, all standard application / DVR / NVR / camera etc. devices with UPnP can open automatically the needed ports.
I made an ultra-limited skin in WebFig and as it turns out, the new user group I made can’t change the skin, so this is just what I needed. 
Warning: the same user and password can access with winbox /telnet / ssh
must be set also the right on user group, not only skin!