action - prevent user from deleting - acl

running on Ubuntu Focal with kvm and ldap auth against companys central LDAP. Everything is fine so far. I’d like to give Developers the possibility to create Dev/Test VMs but i’d like to terminate them automatically after time. No long term VMs for testing. Forcing automation in setup preparation.

Now i offered them a template which has everything set like network, mem, disk, image etc and an terminate action after 3 days.

Devs immediatly found out they could delete the terminate action after instantiating the new VM.

I’d like to prevent this but i couldnt find any way of doing so by reading through acl documentation. Is there a way or do i need to somehow implement this via the api and onevm?