Yes, this is a top priority.
We used to have a method that would validate the metadata model after the merge and throw an exception if the constraints defined by the XSD wasn't correct.
The datasource part is easier since there is only one place where the information can come from (XML), so the parser can be a lot more strict there.
As to updates from the management layer - the management facade must verify that the update is correct before sending the value to the instance. However, we can only do basic tests here, but that should be enough.
Implementation: If a builder pattern can help, go for it. The current requirements for the metadata model can't be changed though.