A method performed by a computer or a set of computers of processing a change to a state of a particular managed server included in a plurality of managed servers (130A, 130B) that use management instructions to configure management modules (132, 134, 136) so that the configured management modules implement a set of one or more rules, the method comprising: modifying a first description of the particular managed server to indicate the particular managed server's changed state, thereby specifying a second description of the particular managed server; comparing the unmodified first description to the second description, thereby specifying a description change; determining, based on the description change, whether to update management instructions previously sent to the particular managed server; and responsive to determining to update the particular managed server's management instructions: determining, based on the second description, which rules within the set of rules specify a provided-by portion or a used-by portion applicable to the particular managed server, thereby specifying currently-relevant rules, - wherein the provided-by portion describes which managed servers and/or unmanaged devices can provide a service specified in the rule, and - wherein the used-by portion describes which managed servers and/or unmanaged devices can use said service; determining whether the currently-relevant rules differ from previously-relevant rules, wherein the previously-relevant rules were determined based on the unmodified first description; responsive to determining that the currently-relevant rules differ from the previously-relevant rules: determining a rule that should be added relative to the previously-relevant rules; generating, based on the determined rule, a function-level instruction; and sending, to the particular managed server, the function-level instruction and an instruction to add the function-level instruction; and responsive to determining that the currently-relevant rules are identical to the previously-relevant rules, taking no further action. modifying a first description of the particular managed server to indicate the particular managed server's changed state, thereby specifying a second description of the particular managed server; comparing the unmodified first description to the second description, thereby specifying a description change; determining, based on the description change, whether to update management instructions previously sent to the particular managed server; and responsive to determining to update the particular managed server's management instructions: determining, based on the second description, which rules within the set of rules specify a provided-by portion or a used-by portion applicable to the particular managed server, thereby specifying currently-relevant rules, - wherein the provided-by portion describes which managed servers and/or unmanaged devices can provide a service specified in the rule, and - wherein the used-by portion describes which managed servers and/or unmanaged devices can use said service; determining whether the currently-relevant rules differ from previously-relevant rules, wherein the previously-relevant rules were determined based on the unmodified first description; responsive to determining that the currently-relevant rules differ from the previously-relevant rules: determining a rule that should be added relative to the previously-relevant rules; generating, based on the determined rule, a function-level instruction; and sending, to the particular managed server, the function-level instruction and an instruction to add the function-level instruction; and responsive to determining that the currently-relevant rules are identical to the previously-relevant rules, taking no further action. determining, based on the second description, which rules within the set of rules specify a provided-by portion or a used-by portion applicable to the particular managed server, thereby specifying currently-relevant rules, - wherein the provided-by portion describes which managed servers and/or unmanaged devices can provide a service specified in the rule, and - wherein the used-by portion describes which managed servers and/or unmanaged devices can use said service; - wherein the provided-by portion describes which managed servers and/or unmanaged devices can provide a service specified in the rule, and - wherein the used-by portion describes which managed servers and/or unmanaged devices can use said service; determining whether the currently-relevant rules differ from previously-relevant rules, wherein the previously-relevant rules were determined based on the unmodified first description; responsive to determining that the currently-relevant rules differ from the previously-relevant rules: determining a rule that should be added relative to the previously-relevant rules; generating, based on the determined rule, a function-level instruction; and sending, to the particular managed server, the function-level instruction and an instruction to add the function-level instruction; and determining a rule that should be added relative to the previously-relevant rules; generating, based on the determined rule, a function-level instruction; and sending, to the particular managed server, the function-level instruction and an instruction to add the function-level instruction; and responsive to determining that the currently-relevant rules are identical to the previously-relevant rules, taking no further action.