> as long as you have a way to report on the current configuration across all deployments

This seems to be the hard part. Some of our deployments are not generally accessible to us.