I've built a system like this recently for a payments platform. Access _is_ possible but requires rebuilding the environment (and thus blowing everything away) as well as admin access.
Is it possible to verify that you cannot access said system, though? How would that even be done? In most scenarios I can imagine you're still rely on the server telling you something about itself... which it can lie about.
You built in on AWS? Using some application of CloudHSM?