Review Variable edit
I suggest you make it possible for Project lead / initiator/ deployer to edit variables.
Those edit´s will then be acceptable by project contributor or System Administrator
You can create a custom User Role for this.
Role Name: Variable manager
Description: Variable managers can view and edit variables.
Roles: VariableEdit, VariableEditUnscoped, VariableView, VariableViewUnscoped