For private disposable apps, make TTL mandatory and show the delete date before deploy. Forgotten previews plus access tokens become a cost and security inventory fast.