The phone is easy to fat-finger on, so every change is built to be hard to do by accident. The rules are enforced by Kubyl Server, not only by the app: the app avoids sending what the server would refuse and shows its refusals in place.
Two steps for every change
Delete (pods can also be force-killed, others take a grace period), scale, rollout restart, rollout undo and pause or resume, cordon, uncordon and drain, CronJob run and suspend, silences, Argo CD and Flux actions, operator install and upgrade approvals, cluster updates, Helm install, upgrade, rollback and uninstall, debug containers and YAML apply all use the same bottom sheet. Prepare shows what would happen (for YAML, a reviewed diff; for Helm, a server-side dry run with the objects, hooks, CRDs and a values diff); Confirm applies it. Nothing changes before you confirm. Actions the desktop runs silently, such as pause or trigger, still go through the sheet on the phone. The scale stepper waits a moment after the last tap and then opens one sheet for the final count.
Production clusters
A cluster can be marked production (shown as PROD). Confirming a change on it asks you to type the cluster's name, whatever the action (the desktop sometimes asks for the application's or operator's name; on the phone the server's rule wins). Some deletes also ask for the object's own name, for example an Argo CD application, a Flux Kustomization or HelmRelease, or a Helm release. A wrong name is refused by the server, in the sheet. Argo CD writes also honor the rules of the cluster an application deploys to, not only the one Argo CD runs on.
Biometrics
Before the app sends the confirmation it asks for Face ID or your passcode. In Settings, Security, you can choose whether to ask before every change; on PROD clusters it always asks. The same page has an app lock with a “Lock after” delay (Immediately, 10 seconds, 1 minute or 5 minutes).
Read-only clusters
A cluster marked read-only refuses all writes. The app hides its actions and shows a “Read-only cluster” chip. Terminals, pod files and port-forwards that could change things are not offered on it either (web views are). Whether a cluster is PROD or read-only is set on the server, per cluster, and is the same for every device; see What the mobile client can and cannot do.
Secrets stay masked
Secret values are masked in objects, YAML, Describe and manifests, and Helm values are shown masked. To read one value you reveal it on purpose: the Config & storage page of a Secret has an eye per key (and the same for Helm values and an OpenShift Route's TLS key). Revealing asks for Face ID or your passcode, is kept in memory only while the page is open, is rate-limited by the server and leaves an audit line (who and what, never the value). Secrets can't be applied or edited from the phone. Kubeconfigs and credentials never leave your server.