Tighten up the provisioning API a bit