Our team has repeated complaints of forgetting to activate Safe Mode as soon as it starts changing something in the box.
My wish/suggestion is to create an option in System -> User -> Group from which it is defined that every time a user of that group accesses any of the equipment's interfaces (Winbox, SSH / Telnet, etc.) that this user already start accessing in Safe Mode compulsorily.
A second alternative solution to the same problem is:
The same as a user with write permissions, these write options are only enabled from the moment the user activates safe mode for the first time.
Logically, the choice for this mode of operation should also be configurable from a checkbox in System -> User -> Group