Use my pre-commit hook. You can specify down to individual file levels who has commit permission on particular files. For example, you could do this in the Control file:
[file You are not allowed to modify template files]
file = /**/*.template
access = read-only
users = @ALL
[file Bob is allowed to change the templates]
file = /**/*.template
access = read-write
users = bob
Now, users won't be able to modify your template files anywhere on your system (i.e. assuming they end in the suffix template), but Bob, who is smart and handsome, can modify the template files when needed.
I originally wrote this pre-commit hook to allow users to create, but not modify tags:
[file You can't modify a tag]
file = /tag/**
access = read-only
users = @ALL
[file You can't modify a tag]
file = /tag/*
access = add-only
users = @ALL
This allows all users to create a new tag, but no one is allowed to commit changes to a tag once it has been created.