We've had a couple of incidents peak season where someone has removed all unshipped orders and the logs just show the parent account.

Ideally, I'd like to disable it completely, like a toggle in the backend settings, but if it could be disabled from child accounts, that would also suffice.