Expand the existing "Lock" function in the Metal console & API so that admins can prevent a wider set of actions. Currently, locking a server only prevents it from being deleted or reinstalled.
The proposed feature would mean that all platform-directed configurations (e.g. adding/removing VLAN's) or status changes (powering on/off/reboot) would require an account admin to first unlock the instance.