Resource locks

Azure lock parity: a CanNotDelete / ReadOnly marker on a resource that the factory enforces on delete/save.

Why deferred

Single-owner resources today — the type-the-name delete confirmation (resource page parity) and the recycle bin already cover accidental destruction, which is the entire threat model locks address without collaborators.

Revisit when

Collaboration ships (resource collaboration) — protecting a resource from other editors is when locks earn a column.

Resource groups

Deferred — Azure-style user-defined grouping of resources in the explorer list.

Resource references

Deferred — a maintained reference index answering "what consumes this resource" (which dashboards, emails, or imports point at it).