How to lock configuration settings in Magento2 Admin?

There seem to be three places for configuration / settings:

  1. env.php
  2. config.php
  3. database (via Admin > Stores > Configuration > …)

For some of the settings available in Magento Admin I would prefer a read-only approach. This seems to be less flexible, but much safer to me.

I have in my mind, that configuration settings defined in the two configuration files cannot be overwritten in Magento Admin – but that turned out to be untrue in my installation (2.2.5):

  • I have some settings in Admin, which I have defined in env.php for the global scope, and I can easily edit the values after having removed the tick from the box “Use Default” / “Use Website”.
  • Other settings in Admin I cannot change at all: The field is greyed out.

I have not found out yet how I can control this behavior. How can I lock a specific setting a) globally for all stores and websites – and b) on individual levels only?