Something akin to Mikrotik's "device mode".

https://help.mikrotik.com/docs/spaces/ROS/pages/93749258/Dev...

If I have to enable a privileged operation (like enable container support), I have to change a device-mode flag. To confirm it, I have to either physically push the Reset button on the device or pull the power from it physically within a set window of time.

Push the setting to the freezer but require a physical button press/power control action from someone locally to confirm the new setting change.

Have a big pop-up message on the HMI that says "TEMP CHANGE REQUEST: CURRENTLY 0C, REQUESTED 66C - OK?" so someone can yelp and go This doesn't look right! and call in the experts for help.

Is it perfect? No. Could it be feasible for some applications? Yes.