I more generic solution would be scheduler classes, as per SVR4 (with
extensions, of course).
Trusted users could have their login shell in a class which allows
high CPU usage - i.e. their processes would be allowed to occupy
the high level run queues. As child process inherit their scheduler
class from their parent's, all should be well.
Other users would be given a class which is only allowed to occupy
the lower level queues.
...other variations...
Scheduling of processes could be based upon real memory usage, page
faults, etc, as well as CPU usage - depending upon the class.
Different classes could be written for different environments, with
the schedulers loaded as modules :)
markhe