diff --git a/library/blivet.py b/library/blivet.py

index cb48e71..e1903f3 100644

--- a/library/blivet.py

+++ b/library/blivet.py

@@ -167,11 +167,16 @@ class BlivetBase(object):

         raise NotImplementedError()

     def _manage_one_encryption(self, device):

+        global safe_mode

         ret = device

         # Make sure to handle adjusting both existing stacks and future stacks.

         if device == device.raw_device and self._spec_dict['encryption']:

             # add luks

             luks_name = "luks-%s" % device._name

+            if safe_mode and (device.original_format.type is not None or

+                              device.original_format.name != get_format(None).name):

+                raise BlivetAnsibleError("cannot remove existing formatting on device '%s' in safe mode due to adding encryption" %

+                                         device._name)

             if not device.format.exists:

                 fmt = device.format

             else:

@@ -196,6 +201,10 @@ class BlivetBase(object):

             ret = luks_device

         elif device != device.raw_device and not self._spec_dict['encryption']:

             # remove luks

+            if safe_mode and (device.original_format.type is not None or

+                              device.original_format.name != get_format(None).name):

+                raise BlivetAnsibleError("cannot remove existing formatting on device '%s' in safe mode due to encryption removal" %

+                                         device._name)

             if not device.format.exists:

                 fmt = device.format

             else:

@@ -823,17 +832,21 @@ class BlivetPool(BlivetBase):

     def manage(self):

         """ Schedule actions to configure this pool according to the yaml input. """

+        global safe_mode

         # look up the device

         self._look_up_disks()

         self._look_up_device()

         # schedule destroy if appropriate, including member type change

-        if not self.ultimately_present or self._member_management_is_destructive():

-            if not self.ultimately_present:

-                self._manage_volumes()

+        if not self.ultimately_present:

+            self._manage_volumes()

             self._destroy()

-            if not self.ultimately_present:

-                return

+            return

+        elif self._member_management_is_destructive():

+            if safe_mode:

+                raise BlivetAnsibleError("cannot remove and recreate existing pool '%s' in safe mode" % self._pool['name'])

+            else:

+                self._destroy()

         # schedule create if appropriate

         self._create()

diff --git a/tests/create-test-file.yml b/tests/create-test-file.yml

new file mode 100644

index 0000000..d1091e2

--- /dev/null

+++ b/tests/create-test-file.yml

@@ -0,0 +1,13 @@

+# Create a file to be checked that it still exists and no data loss has occured.

+# To use:

+# - set testfile to a path under the mountpoint being tested

+# - include this file (create-test-file.yml) before executing the

+#   operation to be tested

+# - execute the operation that could potentially result in a loss of

+#   data in the filesystem where testfile is located

+# - include verify-data-preservation.yml

+

+- name: create a file

+  file:

+    path: "{{ testfile }}"

+    state: touch

diff --git a/tests/tests_luks.yml b/tests/tests_luks.yml

index f93efe5..f733714 100644

--- a/tests/tests_luks.yml

+++ b/tests/tests_luks.yml

@@ -2,8 +2,8 @@

 - hosts: all

   become: true

   vars:

-    storage_safe_mode: false

     mount_location: '/opt/test1'

+    testfile: "{{ mount_location }}/quux"

     volume_size: '5g'

   tasks:

@@ -64,10 +64,47 @@

     - include_tasks: verify-role-results.yml

+    - import_tasks: create-test-file.yml

+

+    - name: Test for correct handling of safe_mode

+      block:

+        - name: Remove the encryption layer

+          include_role:

+            name: storage

+          vars:

+            storage_volumes:

+              - name: foo

+                type: disk

+                disks: "{{ unused_disks }}"

+                mount_point: "{{ mount_location }}"

+                encryption: false

+                encryption_password: 'yabbadabbadoo'

+        - name: unreachable task

+          fail:

+            msg: UNREACH

+      rescue:

+        - name: Check that we failed in the role

+          assert:

+            that:

+              - ansible_failed_result.msg != 'UNREACH'

+            msg: "Role has not failed when it should have"

+

+        - name: Verify the output of the safe_mode test

+          assert:

+            that: "blivet_output.failed and

+                   blivet_output.msg

+                   |regex_search('cannot remove existing

+                   formatting.*in safe mode due to encryption removal')

+                   and not blivet_output.changed"

+            msg: "Unexpected behavior w/ existing filesystem in safe mode"

+

+    - import_tasks: verify-data-preservation.yml

+

     - name: Remove the encryption layer

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_volumes:

           - name: foo

             type: disk

@@ -78,10 +115,47 @@

     - include_tasks: verify-role-results.yml

+    - import_tasks: create-test-file.yml

+

+    - name: Test for correct handling of safe_mode

+      block:

+        - name: Add encryption to the volume

+          include_role:

+            name: storage

+          vars:

+            storage_volumes:

+              - name: foo

+                type: disk

+                disks: "{{ unused_disks }}"

+                mount_point: "{{ mount_location }}"

+                encryption: true

+                encryption_password: 'yabbadabbadoo'

+        - name: unreachable task

+          fail:

+            msg: UNREACH

+      rescue:

+        - name: Check that we failed in the role

+          assert:

+            that:

+              - ansible_failed_result.msg != 'UNREACH'

+            msg: "Role has not failed when it should have"

+

+        - name: Verify the output of the safe_mode test

+          assert:

+            that: "blivet_output.failed and

+                   blivet_output.msg

+                   |regex_search('cannot remove existing

+                   formatting.*in safe mode due to adding encryption')

+                   and not blivet_output.changed"

+            msg: "Unexpected behavior w/ existing filesystem in safe mode"

+

+    - import_tasks: verify-data-preservation.yml

+

     - name: Add encryption to the volume

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_volumes:

           - name: foo

             type: disk

@@ -102,6 +176,7 @@

           include_role:

             name: storage

           vars:

+            storage_safe_mode: false

             storage_pools:

               - name: foo

                 type: partition

@@ -135,6 +210,7 @@

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_pools:

           - name: foo

             type: partition

@@ -149,10 +225,51 @@

     - include_tasks: verify-role-results.yml

+    - import_tasks: create-test-file.yml

+

+    - name: Test for correct handling of safe_mode

+      block:

+        - name: Remove the encryption layer

+          include_role:

+            name: storage

+          vars:

+            storage_pools:

+              - name: foo

+                type: partition

+                disks: "{{ unused_disks }}"

+                volumes:

+                  - name: test1

+                    type: partition

+                    mount_point: "{{ mount_location }}"

+                    size: 4g

+                    encryption: false

+                    encryption_password: 'yabbadabbadoo'

+        - name: unreachable task

+          fail:

+            msg: UNREACH

+      rescue:

+        - name: Check that we failed in the role

+          assert:

+            that:

+              - ansible_failed_result.msg != 'UNREACH'

+            msg: "Role has not failed when it should have"

+

+        - name: Verify the output of the safe_mode test

+          assert:

+            that: "blivet_output.failed and

+                   blivet_output.msg

+                   |regex_search('cannot remove existing

+                   formatting.*in safe mode due to encryption removal')

+                   and not blivet_output.changed"

+            msg: "Unexpected behavior w/ existing filesystem in safe mode"

+

+    - import_tasks: verify-data-preservation.yml

+

     - name: Remove the encryption layer

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_pools:

           - name: foo

             type: partition

@@ -167,6 +284,48 @@

     - include_tasks: verify-role-results.yml

+    - import_tasks: create-test-file.yml

+

+    - name: Test for correct handling of safe_mode

+      block:

+        - name: Add encryption to the volume

+          include_role:

+            name: storage

+          vars:

+            storage_pools:

+              - name: foo

+                type: partition

+                disks: "{{ unused_disks }}"

+                volumes:

+                  - name: test1

+                    type: partition

+                    mount_point: "{{ mount_location }}"

+                    size: 4g

+                    encryption: true

+                    encryption_password: 'yabbadabbadoo'

+

+        - name: unreachable task

+          fail:

+            msg: UNREACH

+

+      rescue:

+        - name: Check that we failed in the role

+          assert:

+            that:

+              - ansible_failed_result.msg != 'UNREACH'

+            msg: "Role has not failed when it should have"

+

+        - name: Verify the output of the safe_mode test

+          assert:

+            that: "blivet_output.failed and

+                   blivet_output.msg

+                   |regex_search('cannot remove existing

+                   formatting.*in safe mode due to adding encryption')

+                   and not blivet_output.changed"

+            msg: "Unexpected behavior w/ existing volume in safe mode"

+

+    - import_tasks: verify-data-preservation.yml

+

     - name: Test key file handling

       block:

         - name: Create a key file

@@ -186,6 +345,7 @@

           include_role:

             name: storage

           vars:

+            storage_safe_mode: false

             storage_pools:

               - name: foo

                 type: partition

@@ -216,6 +376,7 @@

           include_role:

             name: storage

           vars:

+            storage_safe_mode: false

             storage_pools:

               - name: foo

                 type: lvm

@@ -248,6 +409,7 @@

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_pools:

           - name: foo

             type: lvm

@@ -264,10 +426,52 @@

     - include_tasks: verify-role-results.yml

+    - import_tasks: create-test-file.yml

+

+    - name: Test for correct handling of safe_mode

+      block:

+        - name: Remove the encryption layer

+          include_role:

+            name: storage

+          vars:

+            storage_pools:

+              - name: foo

+                type: lvm

+                disks: "{{ unused_disks }}"

+                volumes:

+                  - name: test1

+                    mount_point: "{{ mount_location }}"

+                    size: 4g

+                    encryption: false

+                    encryption_password: 'yabbadabbadoo'

+

+        - name: unreachable task

+          fail:

+            msg: UNREACH

+

+      rescue:

+        - name: Check that we failed in the role

+          assert:

+            that:

+              - ansible_failed_result.msg != 'UNREACH'

+            msg: "Role has not failed when it should have"

+

+        - name: Verify the output of the safe_mode test

+          assert:

+            that: "blivet_output.failed and

+                   blivet_output.msg

+                   |regex_search('cannot remove existing

+                   formatting.*in safe mode due to encryption removal')

+                   and not blivet_output.changed"

+            msg: "Unexpected behavior w/ existing volume in safe mode"

+

+    - import_tasks: verify-data-preservation.yml

+

     - name: Remove the encryption layer

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_pools:

           - name: foo

             type: lvm

@@ -281,10 +485,52 @@

     - include_tasks: verify-role-results.yml

+    - import_tasks: create-test-file.yml

+

+    - name: Test for correct handling of safe_mode

+      block:

+        - name: Add encryption to the volume

+          include_role:

+            name: storage

+          vars:

+            storage_pools:

+              - name: foo

+                type: lvm

+                disks: "{{ unused_disks }}"

+                volumes:

+                  - name: test1

+                    mount_point: "{{ mount_location }}"

+                    size: 4g

+                    encryption: true

+                    encryption_password: 'yabbadabbadoo'

+

+        - name: unreachable task

+          fail:

+            msg: UNREACH

+

+      rescue:

+        - name: Check that we failed in the role

+          assert:

+            that:

+              - ansible_failed_result.msg != 'UNREACH'

+            msg: "Role has not failed when it should have"

+

+        - name: Verify the output of the safe_mode test

+          assert:

+            that: "blivet_output.failed and

+                   blivet_output.msg

+                   |regex_search('cannot remove existing

+                   formatting.*in safe mode due to adding encryption')

+                   and not blivet_output.changed"

+            msg: "Unexpected behavior w/ existing volume in safe mode"

+

+    - import_tasks: verify-data-preservation.yml

+

     - name: Add encryption to the volume

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_pools:

           - name: foo

             type: lvm

diff --git a/tests/tests_luks_pool.yml b/tests/tests_luks_pool.yml

index b20b806..f44916f 100644

--- a/tests/tests_luks_pool.yml

+++ b/tests/tests_luks_pool.yml

@@ -2,9 +2,10 @@

 - hosts: all

   become: true

   vars:

-    storage_safe_mode: false

     mount_location: '/opt/test1'

     mount_location_2: '/opt/test2'

+    testfile: "{{ mount_location }}/quux"

+    testfile_location_2: "{{ mount_location_2 }}/quux"

     volume_size: '5g'

   tasks:

@@ -92,10 +93,50 @@

             state: absent

           changed_when: false

+    - import_tasks: create-test-file.yml

+

+    - name: Test for correct handling of safe_mode

+      block:

+        - name: Remove the encryption layer

+          include_role:

+            name: storage

+          vars:

+            storage_pools:

+              - name: foo

+                type: lvm

+                disks: "{{ unused_disks }}"

+                encryption: false

+                encryption_password: 'yabbadabbadoo'

+                volumes:

+                  - name: test1

+                    mount_point: "{{ mount_location }}"

+                    size: 4g

+        - name: unreachable task

+          fail:

+            msg: UNREACH

+      rescue:

+        - name: Check that we failed in the role

+          assert:

+            that:

+              - ansible_failed_result.msg != 'UNREACH'

+            msg: "Role has not failed when it should have"

+

+        - name: Verify the output of the safe_mode test

+          assert:

+            that: "blivet_output.failed and

+                   blivet_output.msg

+                   |regex_search('cannot remove and recreate existing

+                   pool.*in safe mode')

+                   and not blivet_output.changed"

+            msg: "Unexpected behavior w/ existing pool in safe mode"

+

+    - import_tasks: verify-data-preservation.yml

+

     - name: Remove the encryption layer

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_pools:

           - name: foo

             type: lvm

@@ -109,10 +150,53 @@

     - include_tasks: verify-role-results.yml

-    - name: Add encryption to the volume

+    - import_tasks: create-test-file.yml

+

+    - name: Test for correct handling of safe_mode

+      block:

+        - name: Add encryption to the pool

+          include_role:

+            name: storage

+          vars:

+            storage_pools:

+              - name: foo

+                type: lvm

+                disks: "{{ unused_disks }}"

+                encryption: true

+                encryption_password: 'yabbadabbadoo'

+                encryption_luks_version: luks1

+                encryption_key_size: 512

+                encryption_cipher: 'serpent-xts-plain64'

+                volumes:

+                  - name: test1

+                    mount_point: "{{ mount_location }}"

+                    size: 4g

+        - name: unreachable task

+          fail:

+            msg: UNREACH

+      rescue:

+        - name: Check that we failed in the role

+          assert:

+            that:

+              - ansible_failed_result.msg != 'UNREACH'

+            msg: "Role has not failed when it should have"

+

+        - name: Verify the output of the safe_mode test

+          assert:

+            that: "blivet_output.failed and

+                   blivet_output.msg

+                   |regex_search('cannot remove and recreate existing

+                   pool.*in safe mode')

+                   and not blivet_output.changed"

+            msg: "Unexpected behavior w/ existing pool in safe mode"

+

+    - import_tasks: verify-data-preservation.yml

+

+    - name: Add encryption to the pool

       include_role:

         name: storage

       vars:

+        storage_safe_mode: false

         storage_pools:

           - name: foo

             type: lvm

@@ -129,6 +213,8 @@

     - include_tasks: verify-role-results.yml

+    - import_tasks: create-test-file.yml

+

     - name: Change the mountpoint, leaving encryption in place

       include_role:

         name: storage

@@ -144,6 +230,10 @@

                 mount_point: "{{ mount_location_2 }}"

                 size: 4g

+    - import_tasks: verify-data-preservation.yml

+      vars:

+        testfile: "{{ testfile_location_2 }}"

+

     - include_tasks: verify-role-results.yml

     - name: Clean up

diff --git a/tests/verify-data-preservation.yml b/tests/verify-data-preservation.yml

new file mode 100644

index 0000000..eed790f

--- /dev/null

+++ b/tests/verify-data-preservation.yml

@@ -0,0 +1,19 @@

+# Verify that a file still exists and no data loss has occured.

+# To use:

+# - set testfile to a path under the mountpoint being tested

+# - include create-test-file.yml before executing the operation to be

+#   tested

+# - execute the operation that could potentially result in a loss of

+#   data in the filesystem where testfile is located

+# - include this file (verify-data-preservation.yml)

+

+- name: stat the file

+  stat:

+    path: "{{ testfile }}"

+  register: stat_r

+

+- name: assert file presence

+  assert:

+    that:

+      stat_r.stat.isreg is defined and stat_r.stat.isreg

+    msg: "data lost!"