I think it's the design. It should have been fault-tolerant to possible issues exactly like this, and should not allow the configuration to go live in the first

I think it's the design. It should have been fault-tolerant to possible issues exactly like this, and should not allow the configuration to go live in the first place, in case the person or team pushing the configuration makes a mistake (or a sabotage attempt).