A system (112, 200, 900) for managing a cloud-based data center operative to support a plurality of tenants (102-1 to 102-N) which request access to at least one of resources and services from the data center, the system comprising: a plurality of leaf servers (204-1 to 204-K) each configured to execute a tenant policy enforcement module operative to facilitate enrollment of one or more tenants for the resources and services supported by the data center and to control the one or more tenants' access to the at least one of the resources and services upon authentication and authorization of the one or more tenants; a plurality of chain servers (202-1 to 202-M) each configured to execute a tenant policy decision module (212-1 to 212-M) in association with a smart contract execution module (214-1 to 214-M), wherein the tenant policy decision module executing on a chain server is operative responsive to a request from a leaf server (204-1 to 204-K) for access on behalf of a tenant to the at least one of resources and services provided by the plurality of leaf servers; a plurality of persistent storage devices (206-1 to 206-M) associated with the plurality of chain servers (202-1 to 202-M), wherein each persistent storage device (206-1 to 206-M) is coupled to a corresponding chain server (202-1 to 202-M) and configured to store tenant records in a blockchain replica (216-1 to 216-M), wherein each tenant record is operative to contain compiled bytecode generated from one or more smart contracts associated with a tenant's service management agreement, a plurality of state variables describing a current state of the tenant's account, and one or more data fields operative to support blockchain management and navigation within the blockchain replica (216-1 to 216-M).; and a communications network interconnecting the plurality of leaf servers (204-1 to 204-K), the plurality of chain servers (202-1 to 202-M) and at least a subset of the plurality of the persistent storage devices (206-1 to 206-M) for effectuating communications there between, wherein each of the plurality of the chain servers (202-1 to 202-M) comprises a consensus protocol engine operative to maintain consensus among the blockchain replicas (216-1 to 216-M) stored in the plurality of persistent storage devices (206-1 to 206-M). a plurality of leaf servers (204-1 to 204-K) each configured to execute a tenant policy enforcement module operative to facilitate enrollment of one or more tenants for the resources and services supported by the data center and to control the one or more tenants' access to the at least one of the resources and services upon authentication and authorization of the one or more tenants; a plurality of chain servers (202-1 to 202-M) each configured to execute a tenant policy decision module (212-1 to 212-M) in association with a smart contract execution module (214-1 to 214-M), wherein the tenant policy decision module executing on a chain server is operative responsive to a request from a leaf server (204-1 to 204-K) for access on behalf of a tenant to the at least one of resources and services provided by the plurality of leaf servers; a plurality of persistent storage devices (206-1 to 206-M) associated with the plurality of chain servers (202-1 to 202-M), wherein each persistent storage device (206-1 to 206-M) is coupled to a corresponding chain server (202-1 to 202-M) and configured to store tenant records in a blockchain replica (216-1 to 216-M), wherein each tenant record is operative to contain compiled bytecode generated from one or more smart contracts associated with a tenant's service management agreement, a plurality of state variables describing a current state of the tenant's account, and one or more data fields operative to support blockchain management and navigation within the blockchain replica (216-1 to 216-M).; and a communications network interconnecting the plurality of leaf servers (204-1 to 204-K), the plurality of chain servers (202-1 to 202-M) and at least a subset of the plurality of the persistent storage devices (206-1 to 206-M) for effectuating communications there between, wherein each of the plurality of the chain servers (202-1 to 202-M) comprises a consensus protocol engine operative to maintain consensus among the blockchain replicas (216-1 to 216-M) stored in the plurality of persistent storage devices (206-1 to 206-M).