Abstract: A system and method mitigate configuration change risk for a managed service in a customer environment. Reconfiguration commands sent to a management interface are intercepted and provided to a mitigation service executing in the customer environment. The mitigation service computes a risk rating for each such command based on a wide variety of factors. If the risk is low, then the mitigation service passes the command transparently to the management interface for execution. However, if the risk is too high, then the mitigation service requests an authorization code before the command can be executed. The acceptable level of risk may be set jointly by the customer and the managed service provider according to a service level agreement. Authorization codes can confirm performance of many mitigation actions, including approval by the customer or a supervising manager, studying relevant documentation, and clean execution of the command in a testing environment.