I think the GP was assuming the reason sysadmins worry about running DDL is the danger of overwriting/modifying tables the application depends on.

If this is the main concern, you could have two databases (or schemas, if your database supports it).

One for application configuration/storage that the application never runs DDL on and another for user data, where the tables can be created/modified dynamically.

That separation means that, at worst, user data is screwed up if there's a bug in the DDL generation, but the application should still be able to run.

At least, that was my read.