It would be nice if there were a meta argument that could prevent people from doing an unrestricted colmena apply (i.e. without --on).

Or even better, disallow deploying all of a particular tag group at the same time (e.g. it fails if all of the nodes in the @production tag are selected to be deployed)

It's not that hard to forget the --on argument, and in a production setting it could lead to outages. It should be possible to build them all together, but not deploy.