While I agree with this as a general rule, it ignores an entire class of problem. I work in a data preservation space - if we let people delete things every time they wanted to, it'd be a disaster. Instead we 'tombstone' it (hide from everyone but admin), then let someone with some space from the process confirm it actually should be deleted. We've averted dozens of disasters this way.

I'd argue the user must feel in control, as you say, but not necessarily _be_ in control.