Resource locks: CanNotDelete vs ReadOnly, inheritance and who can remove them

Resource locks protect important resources from accidental changes, including by people who have full permissions. Role-based access control (RBAC) might let an Owner delete a production database, but a lock stops the delete until someone deliberately removes the lock first. Locks are a safety catch, not an access-control system: they do not decide who can act, they add a deliberate extra step before dangerous operations. That extra step is exactly what prevents a mistyped command or an over-eager cleanup script from destroying production. Locks also apply to automation, so pipelines and scripts running as service principals are stopped just like people.