Rule 6 of 8 · Chapter III — Guardrails & Cost
Production resource groups wear a CanNotDelete lock.
Why this rule exists
The lock converts "one wrong click deletes prod" into "deleting prod requires a deliberate two-step nobody does accidentally". It costs nothing and has saved estates.
In practice
az lock create at the group level for every prod group. Removing a lock is itself a reviewed change — the friction is the feature.
When it doesn't apply
Ephemeral prod-like perf environments that are rebuilt nightly can skip locks.