diff --git a/.tmpl/describe.go b/.tmpl/describe.go
index 54cdcefa9..27c684596 100644
--- a/.tmpl/describe.go
+++ b/.tmpl/describe.go
@@ -57,7 +57,7 @@ type DescribeCommand struct {
 // Exec invokes the application logic for the command.
 func (c *DescribeCommand) Exec(in io.Reader, out io.Writer) error {
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		Client:             c.Globals.Client,
 		Manifest:           c.manifest,
 		Out:                out,
diff --git a/.tmpl/list.go b/.tmpl/list.go
index 2505e48e9..45ab9740d 100644
--- a/.tmpl/list.go
+++ b/.tmpl/list.go
@@ -58,7 +58,7 @@ type ListCommand struct {
 // Exec invokes the application logic for the command.
 func (c *ListCommand) Exec(in io.Reader, out io.Writer) error {
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		Client:             c.Globals.Client,
 		Manifest:           c.manifest,
 		Out:                out,
diff --git a/.tmpl/test.go b/.tmpl/test.go
index b7df6c57b..12d213a3d 100644
--- a/.tmpl/test.go
+++ b/.tmpl/test.go
@@ -24,12 +24,20 @@ func TestCreate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
-			Args:      args("${CLI_COMMAND} create --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			Args:      args("${CLI_COMMAND} --name foo --service-id 123 --version 1"),
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("${CLI_COMMAND} --name foo --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate Create${CLI_API} API error",
@@ -98,12 +106,20 @@ func TestDelete(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
-			Args:      args("${CLI_API} delete ---service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			Args:      args("${CLI_COMMAND} --name foo --service-id 123 --version 1"),
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("${CLI_COMMAND} --name foo --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate Delete${CLI_API} API error",
@@ -293,12 +309,20 @@ func TestUpdate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("${CLI_COMMAND} --name foo --service-id 123 --version 1"),
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
-			Args:      args("${CLI_COMMAND} update --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			Args:      args("${CLI_COMMAND} --name foo --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate Update${CLI_API} API error",
diff --git a/pkg/argparser/cmd.go b/pkg/argparser/cmd.go
index cf7c873d7..3735dd520 100644
--- a/pkg/argparser/cmd.go
+++ b/pkg/argparser/cmd.go
@@ -105,10 +105,27 @@ type OptionalFloat64 struct {
 	Value float64
 }
 
+// DisallowState enumerates the service states which are permitted in a
+// lookup in ServiceDetails
+type DisallowState uint8
+
+const (
+	// DisallowStateNone means that no states are disallowed
+	DisallowStateNone DisallowState = 0
+	// DisallowStateActive means that 'active' services are disallowed
+	DisallowStateActive = 1 << iota
+	// DisallowStateLocked means that 'locked' services are disallowed
+	DisallowStateLocked
+)
+
+func (in DisallowState) has(state DisallowState) bool {
+	return in&state == state
+}
+
 // ServiceDetailsOpts provides data and behaviours required by the
 // ServiceDetails function.
 type ServiceDetailsOpts struct {
-	AllowActiveLocked  bool
+	DisallowStates     DisallowState
 	AutoCloneFlag      OptionalAutoClone
 	APIClient          api.Interface
 	Manifest           manifest.Data
@@ -140,9 +157,15 @@ func ServiceDetails(opts ServiceDetailsOpts) (serviceID string, serviceVersion *
 		if err != nil {
 			return serviceID, currentVersion, err
 		}
-	} else if !opts.AllowActiveLocked && (fastly.ToValue(v.Active) || fastly.ToValue(v.Locked)) {
+	} else if !opts.DisallowStates.has(DisallowStateActive) && fastly.ToValue(v.Active) {
+		err = fsterr.RemediationError{
+			Inner:       fmt.Errorf("service version %d is active", fastly.ToValue(v.Number)),
+			Remediation: fsterr.AutoCloneRemediation,
+		}
+		return serviceID, v, err
+	} else if !opts.DisallowStates.has(DisallowStateLocked) && fastly.ToValue(v.Locked) {
 		err = fsterr.RemediationError{
-			Inner:       fmt.Errorf("service version %d is not editable", fastly.ToValue(v.Number)),
+			Inner:       fmt.Errorf("service version %d is locked", fastly.ToValue(v.Number)),
 			Remediation: fsterr.AutoCloneRemediation,
 		}
 		return serviceID, v, err
diff --git a/pkg/commands/acl/acl_test.go b/pkg/commands/acl/acl_test.go
index 7596e0528..9762db9d4 100644
--- a/pkg/commands/acl/acl_test.go
+++ b/pkg/commands/acl/acl_test.go
@@ -32,12 +32,20 @@ func TestACLCreate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("acl create --name foo --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("acl create --name foo --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate CreateACL API error",
@@ -121,12 +129,20 @@ func TestACLDelete(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
-			Args:      args("acl delete --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			Args:      args("acl delete --name foo --service-id 123 --version 1"),
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("acl delete --name foo --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate DeleteACL API error",
@@ -338,12 +354,20 @@ func TestACLUpdate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("acl update --name foo --new-name beepboop --service-id 123 --version 1"),
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
-			Args:      args("acl update --name foobar --new-name beepboop --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			Args:      args("acl update --name foo --new-name beepboop --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate UpdateACL API error",
diff --git a/pkg/commands/acl/describe.go b/pkg/commands/acl/describe.go
index 3171774a7..dc8fcbf36 100644
--- a/pkg/commands/acl/describe.go
+++ b/pkg/commands/acl/describe.go
@@ -64,7 +64,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/acl/list.go b/pkg/commands/acl/list.go
index 800e53ece..60e8710b7 100644
--- a/pkg/commands/acl/list.go
+++ b/pkg/commands/acl/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/backend/backend_test.go b/pkg/commands/backend/backend_test.go
index f2977ce65..ddca895a3 100644
--- a/pkg/commands/backend/backend_test.go
+++ b/pkg/commands/backend/backend_test.go
@@ -33,9 +33,31 @@ func TestBackendCreate(t *testing.T) {
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
 		},
-		// The following test is the same as the above but it appends --autoclone
+		// The following test specifies a service version that's 'locked', and
+		// subsequently we expect it to not be cloned as we don't provide the
+		// --autoclone flag and trying to add a backend to an activated service
+		// should cause an error.
+		{
+			Args: args("backend create --service-id 123 --version 2 --address example.com --name www.test.com"),
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			WantError: "service version 2 is locked",
+		},
+		// The following test is the same as the 'active' test above but it appends --autoclone
+		// so we can be sure the backend creation error still occurs.
+		{
+			Args: args("backend create --service-id 123 --version 1 --address example.com --name www.test.com --autoclone"),
+			API: mock.API{
+				ListVersionsFn:  testutil.ListVersions,
+				CloneVersionFn:  testutil.CloneVersionResult(4),
+				CreateBackendFn: createBackendError,
+			},
+			WantError: errTest.Error(),
+		},
+		// The following test is the same as the 'locked' test above but it appends --autoclone
 		// so we can be sure the backend creation error still occurs.
 		{
 			Args: args("backend create --service-id 123 --version 1 --address example.com --name www.test.com --autoclone"),
@@ -125,8 +147,8 @@ func TestBackendCreate(t *testing.T) {
 			},
 			WantOutput: "Created backend www.test.com (service 123 version 4)",
 		},
-		// The following test specifies a service version that's 'inactive', and
-		// subsequently we expect it to be the same editable version.
+		// The following test specifies a service version that's 'inactive' and not 'locked',
+		// and subsequently we expect it to be the same editable version.
 		{
 			Args: args("backend create --service-id 123 --version 3 --address 127.0.0.1 --name www.test.com"),
 			API: mock.API{
diff --git a/pkg/commands/backend/describe.go b/pkg/commands/backend/describe.go
index df948bcb7..20276fb42 100644
--- a/pkg/commands/backend/describe.go
+++ b/pkg/commands/backend/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/backend/list.go b/pkg/commands/backend/list.go
index 72c7af676..ed3841f25 100644
--- a/pkg/commands/backend/list.go
+++ b/pkg/commands/backend/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/compute/deploy_test.go b/pkg/commands/compute/deploy_test.go
index e1bb21fa2..1b07b9674 100644
--- a/pkg/commands/compute/deploy_test.go
+++ b/pkg/commands/compute/deploy_test.go
@@ -198,6 +198,17 @@ func TestDeploy(t *testing.T) {
 			},
 			wantError: fmt.Sprintf("error cloning service version: %s", testutil.Err.Error()),
 		},
+		{
+			name: "service version is locked, clone version error",
+			args: args("compute deploy --service-id 123 --token 123 --version 2"),
+			api: mock.API{
+				CloneVersionFn:      testutil.CloneVersionError,
+				GetPackageFn:        getPackageOk,
+				GetServiceDetailsFn: getServiceDetailsWasm,
+				ListVersionsFn:      testutil.ListVersions,
+			},
+			wantError: fmt.Sprintf("error cloning service version: %s", testutil.Err.Error()),
+		},
 		{
 			name: "list domains error",
 			args: args("compute deploy --service-id 123 --token 123"),
diff --git a/pkg/commands/dictionary/describe.go b/pkg/commands/dictionary/describe.go
index 9ecfc7cdf..b401fe68c 100644
--- a/pkg/commands/dictionary/describe.go
+++ b/pkg/commands/dictionary/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/dictionary/list.go b/pkg/commands/dictionary/list.go
index a9f0b6ccc..9499d35d0 100644
--- a/pkg/commands/dictionary/list.go
+++ b/pkg/commands/dictionary/list.go
@@ -62,7 +62,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 		return fsterr.ErrInvalidVerboseJSONCombo
 	}
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/domain/describe.go b/pkg/commands/domain/describe.go
index 4ecf3cb2c..cf8458da5 100644
--- a/pkg/commands/domain/describe.go
+++ b/pkg/commands/domain/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/domain/list.go b/pkg/commands/domain/list.go
index ae360a120..0de455da4 100644
--- a/pkg/commands/domain/list.go
+++ b/pkg/commands/domain/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/domain/validate.go b/pkg/commands/domain/validate.go
index 0e9a6c3bd..3c3e0455f 100644
--- a/pkg/commands/domain/validate.go
+++ b/pkg/commands/domain/validate.go
@@ -57,7 +57,7 @@ type ValidateCommand struct {
 // Exec invokes the application logic for the command.
 func (c *ValidateCommand) Exec(_ io.Reader, out io.Writer) error {
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/healthcheck/describe.go b/pkg/commands/healthcheck/describe.go
index 5b93eca56..9010d9448 100644
--- a/pkg/commands/healthcheck/describe.go
+++ b/pkg/commands/healthcheck/describe.go
@@ -64,7 +64,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/healthcheck/list.go b/pkg/commands/healthcheck/list.go
index a33bb3875..e173f4f39 100644
--- a/pkg/commands/healthcheck/list.go
+++ b/pkg/commands/healthcheck/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/azureblob/describe.go b/pkg/commands/logging/azureblob/describe.go
index 3247e3038..9a27066d6 100644
--- a/pkg/commands/logging/azureblob/describe.go
+++ b/pkg/commands/logging/azureblob/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/azureblob/list.go b/pkg/commands/logging/azureblob/list.go
index cebe670dc..b9968273c 100644
--- a/pkg/commands/logging/azureblob/list.go
+++ b/pkg/commands/logging/azureblob/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/bigquery/describe.go b/pkg/commands/logging/bigquery/describe.go
index da8343f4b..d2a8dd81e 100644
--- a/pkg/commands/logging/bigquery/describe.go
+++ b/pkg/commands/logging/bigquery/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/bigquery/list.go b/pkg/commands/logging/bigquery/list.go
index bb49da19a..e8cdbaed6 100644
--- a/pkg/commands/logging/bigquery/list.go
+++ b/pkg/commands/logging/bigquery/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/cloudfiles/describe.go b/pkg/commands/logging/cloudfiles/describe.go
index 8a515e6be..3985ca0f1 100644
--- a/pkg/commands/logging/cloudfiles/describe.go
+++ b/pkg/commands/logging/cloudfiles/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/cloudfiles/list.go b/pkg/commands/logging/cloudfiles/list.go
index 8ea716bbc..c4ee1e1b2 100644
--- a/pkg/commands/logging/cloudfiles/list.go
+++ b/pkg/commands/logging/cloudfiles/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/datadog/describe.go b/pkg/commands/logging/datadog/describe.go
index 1ba797910..dcc49dd8a 100644
--- a/pkg/commands/logging/datadog/describe.go
+++ b/pkg/commands/logging/datadog/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/datadog/list.go b/pkg/commands/logging/datadog/list.go
index 1473d2bd0..3e627f609 100644
--- a/pkg/commands/logging/datadog/list.go
+++ b/pkg/commands/logging/datadog/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/digitalocean/describe.go b/pkg/commands/logging/digitalocean/describe.go
index 71d0353c4..d551d5f42 100644
--- a/pkg/commands/logging/digitalocean/describe.go
+++ b/pkg/commands/logging/digitalocean/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/digitalocean/list.go b/pkg/commands/logging/digitalocean/list.go
index a1e740788..de41f5e3a 100644
--- a/pkg/commands/logging/digitalocean/list.go
+++ b/pkg/commands/logging/digitalocean/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/elasticsearch/describe.go b/pkg/commands/logging/elasticsearch/describe.go
index c7c8b7ba4..99ad8c77a 100644
--- a/pkg/commands/logging/elasticsearch/describe.go
+++ b/pkg/commands/logging/elasticsearch/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/elasticsearch/list.go b/pkg/commands/logging/elasticsearch/list.go
index 6dd53b084..9ca87e28c 100644
--- a/pkg/commands/logging/elasticsearch/list.go
+++ b/pkg/commands/logging/elasticsearch/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/ftp/describe.go b/pkg/commands/logging/ftp/describe.go
index ecc4292a5..c5353cf7f 100644
--- a/pkg/commands/logging/ftp/describe.go
+++ b/pkg/commands/logging/ftp/describe.go
@@ -59,7 +59,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/ftp/list.go b/pkg/commands/logging/ftp/list.go
index a6b8f0e1c..cde2a272d 100644
--- a/pkg/commands/logging/ftp/list.go
+++ b/pkg/commands/logging/ftp/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/gcs/describe.go b/pkg/commands/logging/gcs/describe.go
index 0ecae611e..d33983877 100644
--- a/pkg/commands/logging/gcs/describe.go
+++ b/pkg/commands/logging/gcs/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/gcs/list.go b/pkg/commands/logging/gcs/list.go
index f6841a1e0..208de1023 100644
--- a/pkg/commands/logging/gcs/list.go
+++ b/pkg/commands/logging/gcs/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/googlepubsub/describe.go b/pkg/commands/logging/googlepubsub/describe.go
index 479b25b64..f6e25ada7 100644
--- a/pkg/commands/logging/googlepubsub/describe.go
+++ b/pkg/commands/logging/googlepubsub/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/googlepubsub/list.go b/pkg/commands/logging/googlepubsub/list.go
index cc65e9c36..6a6419da6 100644
--- a/pkg/commands/logging/googlepubsub/list.go
+++ b/pkg/commands/logging/googlepubsub/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/heroku/describe.go b/pkg/commands/logging/heroku/describe.go
index 1de4697a3..11fd0c48e 100644
--- a/pkg/commands/logging/heroku/describe.go
+++ b/pkg/commands/logging/heroku/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/heroku/list.go b/pkg/commands/logging/heroku/list.go
index cac714dec..5ec313aa0 100644
--- a/pkg/commands/logging/heroku/list.go
+++ b/pkg/commands/logging/heroku/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/honeycomb/describe.go b/pkg/commands/logging/honeycomb/describe.go
index 6b75dc351..f54bda3bf 100644
--- a/pkg/commands/logging/honeycomb/describe.go
+++ b/pkg/commands/logging/honeycomb/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/honeycomb/list.go b/pkg/commands/logging/honeycomb/list.go
index a51283a36..e8c68d946 100644
--- a/pkg/commands/logging/honeycomb/list.go
+++ b/pkg/commands/logging/honeycomb/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/https/describe.go b/pkg/commands/logging/https/describe.go
index c996a8c10..ea8cb46f5 100644
--- a/pkg/commands/logging/https/describe.go
+++ b/pkg/commands/logging/https/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/https/list.go b/pkg/commands/logging/https/list.go
index 9a9591d4a..7c551e56f 100644
--- a/pkg/commands/logging/https/list.go
+++ b/pkg/commands/logging/https/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/kafka/describe.go b/pkg/commands/logging/kafka/describe.go
index a5eb34347..9f6a8786d 100644
--- a/pkg/commands/logging/kafka/describe.go
+++ b/pkg/commands/logging/kafka/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/kafka/list.go b/pkg/commands/logging/kafka/list.go
index 22fc4e645..d11f9aadc 100644
--- a/pkg/commands/logging/kafka/list.go
+++ b/pkg/commands/logging/kafka/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/kinesis/describe.go b/pkg/commands/logging/kinesis/describe.go
index 6237aefc4..635c87f46 100644
--- a/pkg/commands/logging/kinesis/describe.go
+++ b/pkg/commands/logging/kinesis/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/kinesis/list.go b/pkg/commands/logging/kinesis/list.go
index 2babf1a66..bae55abf4 100644
--- a/pkg/commands/logging/kinesis/list.go
+++ b/pkg/commands/logging/kinesis/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/loggly/describe.go b/pkg/commands/logging/loggly/describe.go
index 5ff0ecf0e..95493d887 100644
--- a/pkg/commands/logging/loggly/describe.go
+++ b/pkg/commands/logging/loggly/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/loggly/list.go b/pkg/commands/logging/loggly/list.go
index 1f1246061..ec0f65bdb 100644
--- a/pkg/commands/logging/loggly/list.go
+++ b/pkg/commands/logging/loggly/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/logshuttle/describe.go b/pkg/commands/logging/logshuttle/describe.go
index 6ff34bb7d..b31c36a33 100644
--- a/pkg/commands/logging/logshuttle/describe.go
+++ b/pkg/commands/logging/logshuttle/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/logshuttle/list.go b/pkg/commands/logging/logshuttle/list.go
index 268894b34..6519e830d 100644
--- a/pkg/commands/logging/logshuttle/list.go
+++ b/pkg/commands/logging/logshuttle/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/newrelic/describe.go b/pkg/commands/logging/newrelic/describe.go
index df0d919e9..9c95f8bed 100644
--- a/pkg/commands/logging/newrelic/describe.go
+++ b/pkg/commands/logging/newrelic/describe.go
@@ -64,7 +64,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/newrelic/list.go b/pkg/commands/logging/newrelic/list.go
index ce6a18d6a..a51e72cfe 100644
--- a/pkg/commands/logging/newrelic/list.go
+++ b/pkg/commands/logging/newrelic/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/newrelic/newrelic_test.go b/pkg/commands/logging/newrelic/newrelic_test.go
index b30dd2178..df1050a2a 100644
--- a/pkg/commands/logging/newrelic/newrelic_test.go
+++ b/pkg/commands/logging/newrelic/newrelic_test.go
@@ -22,12 +22,20 @@ func TestNewRelicCreate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("logging newrelic create --key abc --name foo --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("logging newrelic create --key abc --name foo --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate CreateNewRelic API error",
@@ -108,12 +116,20 @@ func TestNewRelicDelete(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("logging newrelic delete --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("logging newrelic delete --name foobar --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate DeleteNewRelic API error",
@@ -320,12 +336,20 @@ func TestNewRelicUpdate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("logging newrelic update --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("logging newrelic update --name foobar --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate UpdateNewRelic API error",
diff --git a/pkg/commands/logging/newrelicotlp/describe.go b/pkg/commands/logging/newrelicotlp/describe.go
index 2022e2ddc..ee8049199 100644
--- a/pkg/commands/logging/newrelicotlp/describe.go
+++ b/pkg/commands/logging/newrelicotlp/describe.go
@@ -64,7 +64,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/newrelicotlp/list.go b/pkg/commands/logging/newrelicotlp/list.go
index f024c3d63..72231fe68 100644
--- a/pkg/commands/logging/newrelicotlp/list.go
+++ b/pkg/commands/logging/newrelicotlp/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/newrelicotlp/newrelicotlp_test.go b/pkg/commands/logging/newrelicotlp/newrelicotlp_test.go
index 83b9588b6..c520929f9 100644
--- a/pkg/commands/logging/newrelicotlp/newrelicotlp_test.go
+++ b/pkg/commands/logging/newrelicotlp/newrelicotlp_test.go
@@ -22,12 +22,20 @@ func TestNewRelicOTLPCreate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("logging newrelicotlp create --key abc --name foo --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("logging newrelicotlp create --key abc --name foo --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate CreateNewRelicOTLP API error",
@@ -108,12 +116,20 @@ func TestNewRelicOTLPDelete(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("logging newrelicotlp delete --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("logging newrelicotlp delete --name foobar --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate DeleteNewRelic API error",
@@ -320,12 +336,20 @@ func TestNewRelicUpdate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("logging newrelicotlp update --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("logging newrelicotlp update --name foobar --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate UpdateNewRelic API error",
diff --git a/pkg/commands/logging/openstack/describe.go b/pkg/commands/logging/openstack/describe.go
index 0718bf194..f15359944 100644
--- a/pkg/commands/logging/openstack/describe.go
+++ b/pkg/commands/logging/openstack/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/openstack/list.go b/pkg/commands/logging/openstack/list.go
index 3b9a9fff7..621bbe949 100644
--- a/pkg/commands/logging/openstack/list.go
+++ b/pkg/commands/logging/openstack/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/papertrail/describe.go b/pkg/commands/logging/papertrail/describe.go
index 9a7c68650..04ae5ff14 100644
--- a/pkg/commands/logging/papertrail/describe.go
+++ b/pkg/commands/logging/papertrail/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/papertrail/list.go b/pkg/commands/logging/papertrail/list.go
index 96c7bfd41..2eb4f69e5 100644
--- a/pkg/commands/logging/papertrail/list.go
+++ b/pkg/commands/logging/papertrail/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/s3/describe.go b/pkg/commands/logging/s3/describe.go
index ae39d09d0..f7afef59b 100644
--- a/pkg/commands/logging/s3/describe.go
+++ b/pkg/commands/logging/s3/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/s3/list.go b/pkg/commands/logging/s3/list.go
index 379bb0701..1a0c8f86f 100644
--- a/pkg/commands/logging/s3/list.go
+++ b/pkg/commands/logging/s3/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/scalyr/describe.go b/pkg/commands/logging/scalyr/describe.go
index 0b5ce43a4..b36dc1bd0 100644
--- a/pkg/commands/logging/scalyr/describe.go
+++ b/pkg/commands/logging/scalyr/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/scalyr/list.go b/pkg/commands/logging/scalyr/list.go
index 8dabd2ab8..06426f697 100644
--- a/pkg/commands/logging/scalyr/list.go
+++ b/pkg/commands/logging/scalyr/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/sftp/describe.go b/pkg/commands/logging/sftp/describe.go
index 802c30891..d381b9ce2 100644
--- a/pkg/commands/logging/sftp/describe.go
+++ b/pkg/commands/logging/sftp/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/sftp/list.go b/pkg/commands/logging/sftp/list.go
index 716775b3b..6cda4f343 100644
--- a/pkg/commands/logging/sftp/list.go
+++ b/pkg/commands/logging/sftp/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/splunk/describe.go b/pkg/commands/logging/splunk/describe.go
index d94f3801c..c6cfc069f 100644
--- a/pkg/commands/logging/splunk/describe.go
+++ b/pkg/commands/logging/splunk/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/splunk/list.go b/pkg/commands/logging/splunk/list.go
index 9d3d5896e..16ccbcdd3 100644
--- a/pkg/commands/logging/splunk/list.go
+++ b/pkg/commands/logging/splunk/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/sumologic/describe.go b/pkg/commands/logging/sumologic/describe.go
index cbd8ed290..0decad6a6 100644
--- a/pkg/commands/logging/sumologic/describe.go
+++ b/pkg/commands/logging/sumologic/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/sumologic/list.go b/pkg/commands/logging/sumologic/list.go
index 4daedaf49..138781da8 100644
--- a/pkg/commands/logging/sumologic/list.go
+++ b/pkg/commands/logging/sumologic/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/syslog/describe.go b/pkg/commands/logging/syslog/describe.go
index b13718dfd..df1da8a03 100644
--- a/pkg/commands/logging/syslog/describe.go
+++ b/pkg/commands/logging/syslog/describe.go
@@ -63,7 +63,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/logging/syslog/list.go b/pkg/commands/logging/syslog/list.go
index caab65a78..c029b2745 100644
--- a/pkg/commands/logging/syslog/list.go
+++ b/pkg/commands/logging/syslog/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/ratelimit/list.go b/pkg/commands/ratelimit/list.go
index 89956917c..ff248919d 100644
--- a/pkg/commands/ratelimit/list.go
+++ b/pkg/commands/ratelimit/list.go
@@ -59,7 +59,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/serviceversion/activate.go b/pkg/commands/serviceversion/activate.go
index d25214701..6c0202d80 100644
--- a/pkg/commands/serviceversion/activate.go
+++ b/pkg/commands/serviceversion/activate.go
@@ -53,6 +53,7 @@ func NewActivateCommand(parent argparser.Registerer, g *global.Data) *ActivateCo
 // Exec invokes the application logic for the command.
 func (c *ActivateCommand) Exec(_ io.Reader, out io.Writer) error {
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
+		DisallowStates:     argparser.DisallowStateLocked,
 		AutoCloneFlag:      c.autoClone,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
diff --git a/pkg/commands/serviceversion/clone.go b/pkg/commands/serviceversion/clone.go
index 9711303f1..ffb516f30 100644
--- a/pkg/commands/serviceversion/clone.go
+++ b/pkg/commands/serviceversion/clone.go
@@ -48,7 +48,7 @@ func NewCloneCommand(parent argparser.Registerer, g *global.Data) *CloneCommand
 // Exec invokes the application logic for the command.
 func (c *CloneCommand) Exec(_ io.Reader, out io.Writer) error {
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/serviceversion/deactivate.go b/pkg/commands/serviceversion/deactivate.go
index 5c7d64cbf..1f3dd2908 100644
--- a/pkg/commands/serviceversion/deactivate.go
+++ b/pkg/commands/serviceversion/deactivate.go
@@ -48,7 +48,7 @@ func NewDeactivateCommand(parent argparser.Registerer, g *global.Data) *Deactiva
 // Exec invokes the application logic for the command.
 func (c *DeactivateCommand) Exec(_ io.Reader, out io.Writer) error {
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/serviceversion/lock.go b/pkg/commands/serviceversion/lock.go
index 0087d8dc7..c99bd9040 100644
--- a/pkg/commands/serviceversion/lock.go
+++ b/pkg/commands/serviceversion/lock.go
@@ -48,7 +48,7 @@ func NewLockCommand(parent argparser.Registerer, g *global.Data) *LockCommand {
 // Exec invokes the application logic for the command.
 func (c *LockCommand) Exec(_ io.Reader, out io.Writer) error {
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/serviceversion/serviceversion_test.go b/pkg/commands/serviceversion/serviceversion_test.go
index 44103165e..1c74b0427 100644
--- a/pkg/commands/serviceversion/serviceversion_test.go
+++ b/pkg/commands/serviceversion/serviceversion_test.go
@@ -181,6 +181,13 @@ func TestVersionActivate(t *testing.T) {
 			args:      args("service-version activate --service-id 123"),
 			wantError: "error parsing arguments: required flag --version not provided",
 		},
+		{
+			args: args("service-version activate --service-id 123 --version 1"),
+			api: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			wantError: "service version 1 is active",
+		},
 		{
 			args: args("service-version activate --service-id 123 --version 1 --autoclone"),
 			api: mock.API{
@@ -199,6 +206,23 @@ func TestVersionActivate(t *testing.T) {
 			},
 			wantOutput: "Activated service 123 version 4",
 		},
+		{
+			args: args("service-version activate --service-id 123 --version 2"),
+			api: mock.API{
+				ListVersionsFn:    testutil.ListVersions,
+				ActivateVersionFn: activateVersionOK,
+			},
+			wantOutput: "Activated service 123 version 2",
+		},
+		{
+			args: args("service-version activate --service-id 123 --version 2 --autoclone"),
+			api: mock.API{
+				ListVersionsFn:    testutil.ListVersions,
+				CloneVersionFn:    testutil.CloneVersionResult(4),
+				ActivateVersionFn: activateVersionOK,
+			},
+			wantOutput: "Activated service 123 version 4",
+		},
 		{
 			args: args("service-version activate --service-id 123 --version 3 --autoclone"),
 			api: mock.API{
diff --git a/pkg/commands/vcl/condition/describe.go b/pkg/commands/vcl/condition/describe.go
index 789260af7..d1ddf92d9 100644
--- a/pkg/commands/vcl/condition/describe.go
+++ b/pkg/commands/vcl/condition/describe.go
@@ -61,7 +61,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/vcl/condition/list.go b/pkg/commands/vcl/condition/list.go
index f5dc56f0e..838b3dc96 100644
--- a/pkg/commands/vcl/condition/list.go
+++ b/pkg/commands/vcl/condition/list.go
@@ -59,7 +59,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/vcl/custom/custom_test.go b/pkg/commands/vcl/custom/custom_test.go
index 5d976ff09..ad1658b24 100644
--- a/pkg/commands/vcl/custom/custom_test.go
+++ b/pkg/commands/vcl/custom/custom_test.go
@@ -18,12 +18,20 @@ func TestVCLCustomCreate(t *testing.T) {
 	args := testutil.Args
 	scenarios := []testutil.TestScenario{
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("vcl custom create --content ./testdata/example.vcl --name foo --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("vcl custom create --content ./testdata/example.vcl --name foo --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate CreateVCL API error",
@@ -192,12 +200,20 @@ func TestVCLCustomDelete(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("vcl custom delete --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("vcl custom delete --name foobar --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate DeleteVCL API error",
@@ -405,12 +421,20 @@ func TestVCLCustomUpdate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("vcl custom update --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("vcl custom update --name foobar --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate UpdateVCL API error",
diff --git a/pkg/commands/vcl/custom/describe.go b/pkg/commands/vcl/custom/describe.go
index cd22cdcfb..c3d7f7f39 100644
--- a/pkg/commands/vcl/custom/describe.go
+++ b/pkg/commands/vcl/custom/describe.go
@@ -64,7 +64,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/vcl/custom/list.go b/pkg/commands/vcl/custom/list.go
index 7c879608f..6fc3b0e88 100644
--- a/pkg/commands/vcl/custom/list.go
+++ b/pkg/commands/vcl/custom/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/vcl/snippet/describe.go b/pkg/commands/vcl/snippet/describe.go
index 831ee0825..9270635ed 100644
--- a/pkg/commands/vcl/snippet/describe.go
+++ b/pkg/commands/vcl/snippet/describe.go
@@ -68,7 +68,7 @@ func (c *DescribeCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/vcl/snippet/list.go b/pkg/commands/vcl/snippet/list.go
index 0fbf4c74b..f94af5bd1 100644
--- a/pkg/commands/vcl/snippet/list.go
+++ b/pkg/commands/vcl/snippet/list.go
@@ -63,7 +63,7 @@ func (c *ListCommand) Exec(_ io.Reader, out io.Writer) error {
 	}
 
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  true,
+		DisallowStates:     argparser.DisallowStateActive | argparser.DisallowStateLocked,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,
 		Out:                out,
diff --git a/pkg/commands/vcl/snippet/snippet_test.go b/pkg/commands/vcl/snippet/snippet_test.go
index e1f5404e7..fd0eea0f6 100644
--- a/pkg/commands/vcl/snippet/snippet_test.go
+++ b/pkg/commands/vcl/snippet/snippet_test.go
@@ -23,12 +23,20 @@ func TestVCLSnippetCreate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("vcl snippet create --content ./testdata/snippet.vcl --name foo --type recv --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("vcl snippet create --content ./testdata/snippet.vcl --name foo --type recv --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate CreateSnippet API error",
@@ -227,12 +235,20 @@ func TestVCLSnippetDelete(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("vcl snippet delete --name foobar --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("vcl snippet delete --name foobar --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate DeleteSnippet API error",
@@ -455,12 +471,20 @@ func TestVCLSnippetUpdate(t *testing.T) {
 			WantError: "error reading service: no service ID found",
 		},
 		{
-			Name: "validate missing --autoclone flag",
+			Name: "validate missing --autoclone flag with 'active' service",
 			API: mock.API{
 				ListVersionsFn: testutil.ListVersions,
 			},
 			Args:      args("vcl snippet update --service-id 123 --version 1"),
-			WantError: "service version 1 is not editable",
+			WantError: "service version 1 is active",
+		},
+		{
+			Name: "validate missing --autoclone flag with 'locked' service",
+			API: mock.API{
+				ListVersionsFn: testutil.ListVersions,
+			},
+			Args:      args("vcl snippet update --service-id 123 --version 2"),
+			WantError: "service version 2 is locked",
 		},
 		{
 			Name: "validate versioned snippet missing --name",
diff --git a/pkg/commands/vcl/snippet/update.go b/pkg/commands/vcl/snippet/update.go
index c34e4b297..1507c626d 100644
--- a/pkg/commands/vcl/snippet/update.go
+++ b/pkg/commands/vcl/snippet/update.go
@@ -77,8 +77,12 @@ type UpdateCommand struct {
 
 // Exec invokes the application logic for the command.
 func (c *UpdateCommand) Exec(_ io.Reader, out io.Writer) error {
+	var states = argparser.DisallowStateNone
+	if c.dynamic.WasSet && c.dynamic.Value {
+		states = argparser.DisallowStateActive | argparser.DisallowStateLocked
+	}
 	serviceID, serviceVersion, err := argparser.ServiceDetails(argparser.ServiceDetailsOpts{
-		AllowActiveLocked:  c.dynamic.WasSet && c.dynamic.Value,
+		DisallowStates:     states,
 		AutoCloneFlag:      c.autoClone,
 		APIClient:          c.Globals.APIClient,
 		Manifest:           *c.Globals.Manifest,