@Tamas D​  I understood your concern.

1. For cluster creation in different subscription I think that's by design at this moment. But I would like to request you to add your use case to https://feedback.azure.com/d365community/forum/2efba7dc-ef24-ec11-b6e6-000d3a4f0da0# which actually reviewed by our product team to evaluate and in future may be this can be implemented.
2. Also the case goes for hiding the script (if our ACLs does not solve the purpose)

Thanks. Please let me know if you have any queries.

Thanks