Don't make it a configuration option, restrict the option to only very specific conditions, require multiple approvals and verifications, limit the duration of

Don't make it a configuration option, restrict the option to only very specific conditions, require multiple approvals and verifications, limit the duration of the configuration (e.g., it disables after 7 days unless reset), audit it, etc etc.