Create a new role for ALM admin. This role has the possibility to deploy models and to undeploy models. This way you can prevent that workspace administrators take a model out of deployed model by incident.
In our setup we do need people to be workspace admin to be able to assign user roles etc but we do not want them to be able to undeploy models.
As extra detail, we also deploy our development models to prevent people working in the same model without knowing. So to make changes the model needs to be undeployed. This is a potential risk when by accident the worng model (ACC or PROD) is undeployed.
