How to keep developers separate from committers?

[Jean-Christian Imbeault]

My company has just decided to start using CVS. The system admin responsible
for the CVS server is new to CVS and learning as we go along so we are
running into some problems with how to layout our repository etc ...

Please bare with me as I try and explain our situation :)

We're trying to have two modules/projects/branches, one where developers can
do anything and one which is production quality code. We'd like to make it
impossible for the developers to do anything on the production
module/project/branch and only have a few select people who can actually
checkin code to the production module/project/branch. What is the best way
to achieve this?

Our sysadmin could not figure out how to restrict access to branches/modules
so what he ended up doing was creating two directories in the repository,
MRW and MRW_DEV and setting permission so that developers could only access
MRW_DEV but not the other.

So far this has worked well except that when comes time to merge the MRW_DEV
into MRW it isn't possible. I keep having to manually checkout both MRW
*and* MRW_DEV, manually copy files over from MRW_DEV and *then* commit MRW.

I had asked the sysadmin about using branches to make merging easier but he
said that going that route would make it impossible to restrict the
developer's access to just one branch.

What is a better approach to what we want to achieve, i.e. restricting
access but making merging simple?

Thanks,

Jean-Christian Imbeault