A system comprising: a network managed by a service provider and configured to provide access to one or more objects to a set of tenants each having one or more users, the service provider and the set of tenants being part of a set of entities that form a hierarchy, wherein each entity of the set of entities that form the hierarchy is associated with at least one of a parent entity of the set of entities and one or more child entities of the set of entities, the hierarchy comprising a first plurality of tenants (16A, 16B, 16C) that are first-level descendant child entities of the service provider, and one of the first plurality of tenants having a second plurality of tenants (16D, 16E, 16F, 16G, 16H, 16I) that are first-level descendent child entities of the one of the first plurality of tenants, and wherein each object of the set of objects is a virtual execution element, a service or a replication controller; and a controller having access to the network, wherein the controller is configured to: obtain a set of parameters associated with an owner entity of the set of entities, wherein the owner entity is one of the second plurality of tenants, the set of parameters including an indication of the owner entity associated with the rule, an indication of a level of access to an object of the set of objects available to the owner entity, an indication to share the object corresponding to the rule with at least one subset of entities of the set of entities, wherein the indication indicates to share the object with the one of the first plurality of tenants which is the first-level ancestor parent of the owner entity and to not share the object with the service provider which is the second level ancestor of the owner entity, and an indication of whether to share the object with all entities of the set of entities; generate a rule which incorporates the set of parameters, wherein the rule enables the controller to control access to the object; and add the rule to a rules database, wherein the rules database is accessible to the controller. a network managed by a service provider and configured to provide access to one or more objects to a set of tenants each having one or more users, the service provider and the set of tenants being part of a set of entities that form a hierarchy, wherein each entity of the set of entities that form the hierarchy is associated with at least one of a parent entity of the set of entities and one or more child entities of the set of entities, the hierarchy comprising a first plurality of tenants (16A, 16B, 16C) that are first-level descendant child entities of the service provider, and one of the first plurality of tenants having a second plurality of tenants (16D, 16E, 16F, 16G, 16H, 16I) that are first-level descendent child entities of the one of the first plurality of tenants, and wherein each object of the set of objects is a virtual execution element, a service or a replication controller; and a controller having access to the network, wherein the controller is configured to: obtain a set of parameters associated with an owner entity of the set of entities, wherein the owner entity is one of the second plurality of tenants, the set of parameters including an indication of the owner entity associated with the rule, an indication of a level of access to an object of the set of objects available to the owner entity, an indication to share the object corresponding to the rule with at least one subset of entities of the set of entities, wherein the indication indicates to share the object with the one of the first plurality of tenants which is the first-level ancestor parent of the owner entity and to not share the object with the service provider which is the second level ancestor of the owner entity, and an indication of whether to share the object with all entities of the set of entities; generate a rule which incorporates the set of parameters, wherein the rule enables the controller to control access to the object; and add the rule to a rules database, wherein the rules database is accessible to the controller. obtain a set of parameters associated with an owner entity of the set of entities, wherein the owner entity is one of the second plurality of tenants, the set of parameters including an indication of the owner entity associated with the rule, an indication of a level of access to an object of the set of objects available to the owner entity, an indication to share the object corresponding to the rule with at least one subset of entities of the set of entities, wherein the indication indicates to share the object with the one of the first plurality of tenants which is the first-level ancestor parent of the owner entity and to not share the object with the service provider which is the second level ancestor of the owner entity, and an indication of whether to share the object with all entities of the set of entities; generate a rule which incorporates the set of parameters, wherein the rule enables the controller to control access to the object; and add the rule to a rules database, wherein the rules database is accessible to the controller.