Drush: Make site alias read only

Question

I like having site alias defined for easy Drupal management for backing up, syncing dev site with live etc.

But I am afraid of having great loses if I mistyped the drush command having order of site aliases interchanged.

drush sql-sync @dev @live

Instead of:

drush sql-sync @live @dev

Other possibilities include:

drush rsync @dev @live

Is there any option that I can set while defining site aliases that make a site ready only in drush commands? I tried to find one, including drush source code, but didn't succeed.

Of course, outside of drush I can create separate user account that only have ready only access to the site. Also extra database user with no CREATE/UPDATE permissions.

Answer 1

Should be able to do it with drush_hook_COMMAND_validate().

Example: https://github.com/Lullabot/drupal-boilerplate/blob/master/drush/commands/policy.drush.inc