diff --git a/lib/eval-config.nix b/lib/eval-config.nix
index 985470a..7befab1 100644
--- a/lib/eval-config.nix
+++ b/lib/eval-config.nix
@@ -18,6 +18,7 @@ in
     "${modulesPath}/users.nix"
     "${modulesPath}/outputs.nix"
     "${modulesPath}/nixpkgs.nix"
+    "${modulesPath}/misc/assertions.nix"
     # FIXME: we should let the caller inject `pkgs` and `lim` ideally...
   ];
 })
diff --git a/modules/misc/assertions.nix b/modules/misc/assertions.nix
new file mode 100644
index 0000000..427a3fe
--- /dev/null
+++ b/modules/misc/assertions.nix
@@ -0,0 +1,35 @@
+# Taken from NixOS.
+{ lib, ... }:
+
+with lib;
+
+{
+
+  options = {
+
+    assertions = mkOption {
+      type = types.listOf types.unspecified;
+      internal = true;
+      default = [];
+      example = [ { assertion = false; message = "you can't enable this for that reason"; } ];
+      description = ''
+        This option allows modules to express conditions that must
+        hold for the evaluation of the system configuration to
+        succeed, along with associated error messages for the user.
+      '';
+    };
+
+    warnings = mkOption {
+      internal = true;
+      default = [];
+      type = types.listOf types.str;
+      example = [ "The `foo' service is deprecated and will go away soon!" ];
+      description = ''
+        This option allows modules to show warnings to users during
+        the evaluation of the system configuration.
+      '';
+    };
+
+  };
+  # impl of assertions is in <nixpkgs/nixos/modules/system/activation/top-level.nix>
+}
diff --git a/modules/outputs.nix b/modules/outputs.nix
index 84199a2..d1d0c88 100644
--- a/modules/outputs.nix
+++ b/modules/outputs.nix
@@ -5,9 +5,15 @@
 , ...
 }:
 let
-  inherit (lib) mkOption types concatStringsSep;
+  inherit (lib) mkOption types concatStringsSep filter;
   inherit (pkgs) liminix callPackage writeText;
   o = config.system.outputs;
+  # Handle assertions and warnings
+
+  failedAssertions = map (x: x.message) (filter (x: !x.assertion) config.assertions);
+  baseSystemConfiguration = if failedAssertions != []
+    then throw "\nFailed assertions:\n${concatStringsSep "\n" (map (x: "- ${x}") failedAssertions)}"
+    else lib.showWarnings config.warnings o.systemConfiguration;
 in
 {
   imports = [
@@ -121,10 +127,10 @@ in
           inherit (pkgs.pkgsBuildBuild) runCommand;
         in runCommand "mktree" { } ''
           mkdir -p $out/nix/store/ $out/secrets $out/boot
-          cp ${o.systemConfiguration}/bin/activate $out/activate
+          cp ${baseSystemConfiguration}/bin/activate $out/activate
           ln -s ${pkgs.s6-init-bin}/bin/init $out/init
           mkdir -p $out/nix/store
-          for path in $(cat ${o.systemConfiguration}/etc/nix-store-paths) ; do
+          for path in $(cat ${baseSystemConfiguration}/etc/nix-store-paths) ; do
             (cd $out && cp -a $path .$path)
           done
         '';