Answer
Be cautious with the resources-finalizer and prune on the root. Omit the cascading finalizer if you don't want deleting the root to delete children, protect critical children with Prune=false, review parent changes via PR, and scope roots per domain to limit blast radius.
# Omit this on the root if you don't want cascade deletes:
finalizers: [ resources-finalizer.argocd.argoproj.io ]Real-world example The root omits the resources finalizer so removing it doesn't wipe every child environment by accident.