yes, there should be a permissions check. the Application owner should be the only person that can delete the domain.