I like the asymmetry between deploy and delete. Agents don't need equal power across all operations. Giving the agent a useful deployment path while making destructive actions impossible by default is a much cleaner boundary than relying on a long prompt saying "please be careful".