We have this system at work where you have to manually read and type out the estimated number of impacted systems before it lets you issue a command.
@SwiftOnSecurity one time at my very first professional job I wrote a (dangerous) command that defaulted to dry-run and had a flag like "--i-really-mean-it".
A coworker flipped it to default run with a "--dry-run" flag. The commit message was "remove whimsey" and I've never really forgiven them.