diff --git a/README.md b/README.md
index 3cfbe5dfe5..5f2fc0be86 100644
--- a/README.md
+++ b/README.md
@@ -69,12 +69,12 @@ or gem on all your nodes.
        }
     }
 
-### Advanced Example (hiera)
+## Advanced Example (hiera)
 This example includes the `sensu` class as part of a base class or role
 and configures Sensu on each individual node via
 [Hiera](http://docs.puppetlabs.com/#hierahiera1).
 
-hiera.yaml
+### hiera.yaml
 
     ---
     :hierarchy:
@@ -86,7 +86,7 @@ hiera.yaml
     :yaml:
       :datadir: '/etc/puppet/%{environment}/modules/hieradata'
 
-common.yaml
+### common.yaml
 
     sensu::dashboard_port: 8090
     sensu::dashboard_password: mysupersecretpassword
@@ -96,7 +96,7 @@ common.yaml
     sensu::rabbitmq_password: password
     sensu::rabbitmq_port: 5672
 
-sensu-server.foo.com.yaml
+### sensu-server.foo.com.yaml
 
     sensu::server: true
 
@@ -111,8 +111,56 @@ site.pp
       ...
     }
 
+## Safe Mode checks
 
-### Including Sensu monitoring in other modules
+By default Sensu clients will execute whatever check messages are on the
+queue.  This is potentially a large security hole.
+If you enable the safe_mode parameter, it will require that checks are
+defined on the client.  If standalone checks are used then defining on
+the client is sufficient, otherwise checks will also need to be defined
+on the server as well.
+
+A usage example is shown below.
+
+### Sensu server
+
+    node 'sensu-server.foo.com' {
+      class { 'sensu':
+        rabbitmq_password => 'secret',
+        server            => true,
+        plugins           => [
+          'puppet:///data/sensu/plugins/ntp.rb',
+          'puppet:///data/sensu/plugins/postfix.rb'
+        ],
+        safe_mode         => true,
+      }
+
+      ...
+
+      sensu::check { "diskspace":
+        command => '/etc/sensu/plugins/system/check-disk.rb',
+      }
+ 
+
+    }
+
+### Sensu client
+
+    node 'sensu-client.foo.com' {
+       class { 'sensu':
+         rabbitmq_password  => 'secret',
+         rabbitmq_host      => 'sensu-server.foo.com',
+         subscriptions      => 'sensu-test',
+         safe_mode          => true,
+       }
+
+      sensu::check { "diskspace":
+        command => '/etc/sensu/plugins/system/check-disk.rb',
+      }
+    }
+    
+
+## Including Sensu monitoring in other modules
 
 There are a few different patterns that can be used to include Sensu
 monitoring into other modules. One pattern creates a new class that is
diff --git a/lib/puppet/provider/sensu_client_config/json.rb b/lib/puppet/provider/sensu_client_config/json.rb
index 178f4180d2..a64f60e7c6 100644
--- a/lib/puppet/provider/sensu_client_config/json.rb
+++ b/lib/puppet/provider/sensu_client_config/json.rb
@@ -25,6 +25,7 @@ def create
     self.client_name = resource[:client_name]
     self.address = resource[:address]
     self.subscriptions = resource[:subscriptions]
+    self.safe_mode = resource[:safe_mode]
   end
 
   def destroy
@@ -58,4 +59,13 @@ def subscriptions
   def subscriptions=(value)
     @conf['client']['subscriptions'] = value
   end
+
+  def safe_mode
+    @conf['client']['safe_mode']
+  end
+
+  def safe_mode=(value)
+    @conf['client']['safe_mode'] = value
+  end
+
 end
diff --git a/lib/puppet/type/sensu_client_config.rb b/lib/puppet/type/sensu_client_config.rb
index 533dafae71..06a20f97d4 100644
--- a/lib/puppet/type/sensu_client_config.rb
+++ b/lib/puppet/type/sensu_client_config.rb
@@ -37,6 +37,11 @@ def initialize(*args)
     desc ""
   end
 
+  newproperty(:safe_mode, :boolean => true) do
+    desc "Require checks to be defined on server and client"
+    newvalues(:true, :false)
+  end
+
   autorequire(:package) do
     ['sensu']
   end
diff --git a/manifests/client.pp b/manifests/client.pp
index 38c9be8f69..18c752d539 100644
--- a/manifests/client.pp
+++ b/manifests/client.pp
@@ -10,6 +10,7 @@
   $client_name    = $::fqdn,
   $enabled        = 'true',
   $purge_config   = 'false',
+  $safe_mode      = false,
 ) {
 
   $ensure = $enabled ? {
@@ -27,6 +28,7 @@
     client_name   => $client_name,
     address       => $address,
     subscriptions => $subscriptions,
+    safe_mode     => $safe_mode,
   }
 
 }
diff --git a/manifests/init.pp b/manifests/init.pp
index 9511e05e24..f2a8e242f4 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -33,6 +33,7 @@
   $plugins                  = [],
   $purge_config             = false,
   $use_embedded_ruby        = false,
+  $safe_mode                = false,
 ){
 
   Class['sensu::package'] ->
@@ -102,6 +103,7 @@
     client_name   => $client_name,
     enabled       => $client,
     purge_config  => $purge_config,
+    safe_mode     => $safe_mode,
   }
 
   class { 'sensu::service::client': enabled => $client }
diff --git a/spec/classes/sensu_client_spec.rb b/spec/classes/sensu_client_spec.rb
index c46f1945e0..a7dcba62ae 100644
--- a/spec/classes/sensu_client_spec.rb
+++ b/spec/classes/sensu_client_spec.rb
@@ -20,14 +20,16 @@
     let(:params) { {
       :address                  => '1.2.3.4',
       :subscriptions            => ['all'],
-      :client_name              => 'myclient'
+      :client_name              => 'myclient',
+      :safe_mode                => true
     } }
 
     it { should contain_sensu_client_config('host.domain.com').with(
       'client_name'   => 'myclient',
       'address'       => '1.2.3.4',
       'subscriptions' => ['all'],
-      'ensure'        => 'present'
+      'ensure'        => 'present',
+      'safe_mode'     => true
     ) }
 
   end