Wouldn't it be simpler to disallow any changes once the host set up and okayed the configuration?