diff --git a/src/bin/auth/auth_messages.mes b/src/bin/auth/auth_messages.mes
index 872bc3c74d..f5253e6959 100644
--- a/src/bin/auth/auth_messages.mes
+++ b/src/bin/auth/auth_messages.mes
@@ -275,7 +275,7 @@ A separate thread for maintaining data source clients has been started.
 % AUTH_DATASRC_CLIENTS_BUILDER_STOPPED data source builder thread stopped
 The separate thread for maintaining data source clients has been stopped.
 
-% AUTH_DATASRC_CLIENTS_BUILDER_COMMAND data source builder received command, ID: %1
+% AUTH_DATASRC_CLIENTS_BUILDER_COMMAND data source builder received command: %1
 A debug message, showing when the separate thread for maintaining data
 source clients receives a command from the manager.
 
diff --git a/src/bin/auth/datasrc_clients_mgr.h b/src/bin/auth/datasrc_clients_mgr.h
index 9f4e4771bc..c3bf1d2440 100644
--- a/src/bin/auth/datasrc_clients_mgr.h
+++ b/src/bin/auth/datasrc_clients_mgr.h
@@ -25,6 +25,7 @@
 
 #include <auth/auth_log.h>
 
+#include <boost/array.hpp>
 #include <boost/bind.hpp>
 
 #include <list>
@@ -42,7 +43,8 @@ namespace datasrc_clientmgr_internal {
 /// \brief ID of commands from the DataSrcClientsMgr to DataSrcClientsBuilder.
 enum CommandID {
     NOOP,         ///< Do nothing.  Only useful for tests; no argument
-    SHUTDOWN      ///< Shutdown the builder; no argument
+    SHUTDOWN,     ///< Shutdown the builder; no argument
+    NUM_COMMANDS
 };
 
 /// \brief The data type passed from DataSrcClientsMgr to
@@ -262,14 +264,25 @@ bool
 DataSrcClientsBuilderBase<MutexType, CondVarType>::handleCommand(
     const Command& command)
 {
-    LOG_DEBUG(auth_logger, DBGLVL_TRACE_BASIC,
-              AUTH_DATASRC_CLIENTS_BUILDER_COMMAND).arg(command.first);
+    const CommandID cid = command.first;
+    if (cid >= NUM_COMMANDS) {
+        // This shouldn't happen except for a bug within this file.
+        isc_throw(Unexpected, "internal bug: invalid command, ID: " << cid);
+    }
 
+    const boost::array<const char*, NUM_COMMANDS> command_desc = {
+        {"NOOP", "SHUTDOWN"}
+    };
+    LOG_DEBUG(auth_logger, DBGLVL_TRACE_BASIC,
+              AUTH_DATASRC_CLIENTS_BUILDER_COMMAND).arg(command_desc.at(cid));
     switch (command.first) {
     case SHUTDOWN:
         return (false);
     case NOOP:
         doNoop();
+        break;
+    case NUM_COMMANDS:
+        assert(false);          // we rejected this case above
     }
     return (true);
 }
diff --git a/src/bin/auth/tests/datasrc_clients_builder_unittest.cc b/src/bin/auth/tests/datasrc_clients_builder_unittest.cc
index 01a4cb7436..4978d6efe2 100644
--- a/src/bin/auth/tests/datasrc_clients_builder_unittest.cc
+++ b/src/bin/auth/tests/datasrc_clients_builder_unittest.cc
@@ -96,4 +96,11 @@ TEST_F(DataSrcClientsBuilderTest, shutdown) {
     EXPECT_FALSE(builder.handleCommand(shutdown_cmd));
 }
 
+TEST_F(DataSrcClientsBuilderTest, badCommand) {
+    // out-of-range command ID
+    EXPECT_THROW(builder.handleCommand(Command(NUM_COMMANDS,
+                                               ConstElementPtr())),
+                 isc::Unexpected);
+}
+
 } // unnamed namespace