I would start with a provisioning process that isn't completely opaque about such things.