An idea: Protected cvars cannot be altered by the console unless sv_cheats is set to true regardless of difficulty. They can, however, be changed with ACS.
In the first approach it's something like this.
Although I called the flag 'cheat' to do not introduce confusion with existing protected CVARs that can be set from command line but not in console.
