Hmmm... something like that might work... How about this:
Create a new "console redirect" device /dev/consout (0/1?)
and use ttyaction(5) to chown it to the logged in user.
Arrange that open on /dev/consout gives you the privilege
to do console redirection (otherwise same as /dev/console).
Might work?

Simon Raahauge DeSantis writes:
 > 
 > What about not enabling UCONSOLE (thus making TIOCCONS root only), making
 > xconsole and its ilk setiud-root, but having them check for membership in a
 > special group (console group? Wheel? Operator?) this would keep the messy
 > hackishness out of the kernel, and be consistant with su (only members of
 > wheel may su to root) and dump (operators can use it)?
 > 
 > -- 
 > -Simon Raahauge DeSantis