Make sure that the user cannot remove/rename the BE that is currently activated for next boot (the "Default" BE).