diff --git a/pkg/agent/agent.go b/pkg/agent/agent.go
index 31c1a396c..af0409ef1 100644
--- a/pkg/agent/agent.go
+++ b/pkg/agent/agent.go
@@ -485,18 +485,8 @@ func (a *Agent) updateNodeConfig(obj runtime.Object) {
 	if cfg == nil {
 		cfg = a.groupCfg
 	}
-	if cfg == nil {
-		log.Warnf("node (%s) has no effective configuration", a.nodeName)
-		return
-	}
-
-	err := a.notifyFn(cfg)
-	if err != nil {
-		log.Errorf("failed to apply configuration: %v", err)
-	}
 
-	a.patchConfigStatus(a.currentCfg, cfg, err)
-	a.currentCfg = cfg
+	a.updateConfig(cfg)
 }
 
 func (a *Agent) updateGroupConfig(obj runtime.Object) {
@@ -535,11 +525,25 @@ func (a *Agent) updateGroupConfig(obj runtime.Object) {
 		return
 	}
 
+	a.updateConfig(cfg)
+}
+
+func (a *Agent) updateConfig(cfg metav1.Object) {
 	if cfg == nil {
 		log.Warnf("node (%s) has no effective configuration", a.nodeName)
 		return
 	}
 
+	if v, ok := cfg.(cfgapi.Validator); ok {
+		if err := v.Validate(); err != nil {
+			log.Errorf("failed to validate configuration: %v", err)
+
+			a.patchConfigStatus(a.currentCfg, cfg, err)
+			a.currentCfg = cfg
+			return
+		}
+	}
+
 	err := a.notifyFn(cfg)
 	if err != nil {
 		log.Errorf("failed to apply configuration: %v", err)
diff --git a/pkg/apis/config/v1alpha1/validator.go b/pkg/apis/config/v1alpha1/validator.go
new file mode 100644
index 000000000..af50bea52
--- /dev/null
+++ b/pkg/apis/config/v1alpha1/validator.go
@@ -0,0 +1,22 @@
+// Copyright The NRI Plugins Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1alpha1
+
+// Validator is an optional interface that top level configuration types
+// can implement to provide extra custom validation of configuration data.
+// +kubebuilder:object:generate=false
+type Validator interface {
+	Validate() error
+}