Universal Containers (UC) is in a legal dispute regarding several orders.

The enforceable control is the Order Delete object permission. Removing the Delete button from a page layout removes only one user-interface path and does not guarantee that the user cannot delete through another supported interface or API. Likewise, making a page layout read-only controls presentation and field editing but does not revoke the underlying delete capability. UC should remove Delete permission for Order from the affected profiles and permission sets and verify that no permission set group or elevated permission grants it back, because Salesforce permissions are additive. The organization should also review powerful overrides such as Modify All Records or Modify All Data for users who are subject to the legal-retention requirement. If the business needs a formal legal hold, additional retention, backup, audit, and governance controls may be appropriate, but within the supplied choices the correct authorization layer is object CRUD. Study Guide reference: Permissions to Standard Objects, Custom Objects, and Fields - object CRUD, Delete permission, permission aggregation, page-layout limitations, and least privilege.