A company runs a hub virtual network, a shared Azure Firewall, and a central DNS private resolver in a single resource group named 'rg-shared-connectivity'. These resources are critical, and multiple platform engineers have Contributor access to the subscription for daily operations. Recently, an engineer accidentally deleted a route table while cleaning up test resources, causing an outage. Management wants a governance control that prevents any resource in 'rg-shared-connectivity' from being deleted, while still allowing engineers to modify configurations as needed. What should you recommend?