Win32/SCM: Is there a supported way to enforce an exact service environment before any service loader/runtime execution?

I am evaluating a native Win32 service where the initial process environment must be explicitly specified and validated before any environment-dependent loader/runtime execution occurs.

StartServiceW does not expose an environment argument. In the path I am evaluating, failure of the mechanism that constructs the service environment can ultimately result in process creation with a null environment pointer, causing inheritance from the parent.

Is there a documented, supported Windows mechanism that guarantees all of the following for the initial service process:

an explicitly specified/approved environment is used;

failure to construct that environment, null output, or mismatch fails closed before affected process execution;

the guarantee begins before loader/CRT/runtime initialization can consume that environment?

If such a mechanism exists, what API/configuration provides it and where is its contract documented?

If SCM does not provide this guarantee, is that an intentional limitation of the supported service-start contract?

I am specifically asking about the initial service process, not a service subsequently creating a child with an explicit environment.