The http section on delete should be more directive on the allowance for policy to impact actual actions. What actually happens on a delete is going to be highly influenced by policy, and the authority of the request. The behaviou given would be an idealogical pattern, where policy variations are possible.

Also, when a resource is deleted, policy will affect future accesses to that. There can then be a mention of the security page on #AccessDenied