|Do you know where your variables are?|
Due to the huge number of platforms I have to support...
At one time some *nix versions allowed you to 'chmod a+x-r-x YourScript.plx' and the script could execute, but someone couldn't copy it, modify it or delete it. I think the 'user:group' had to be 'bin:bin'. It may not work with your platforms, but you could try it.
Your problem is not a technical one, but a management problem!
Have you mentioned this to the manager(s) of the problem user(s).
Why do they want to allow this?
Good Luck! You need it...Ed
"Well done is better than well said." - Benjamin Franklin