Using core config management, we export configuration from developer's site instances and put than under version control. Eventually, this configuration is merged and ends up in production, where we import it thru either Drush or the UI. Trouble is, site owners have permissions to update block configuration, and this overrides our exported configuration.
What is the intended workflow in this case?
Put more generically: how to manage exported configuration that can be overriden by users (with a core CM workflow)?