A method of managing security of services executing on servers in a network domain, the method performed by a server in a function of a global manager, the method comprising: receiving information describing one or more user groups, each user group containing one or more users associated with the network domain; receiving an association between the user group and a set of labeled entities, wherein a labeled entity is a service or a server (130p, 130q, 130,r, 130s), and wherein the set of labeled entities includes a service associated with a provider server (130q, 130r, 130s) and a consumer server, the association indicating that users of the user group are permitted to access the labeled entities of the set; determining an administrative domain-wide policy based on the received association, the administrative domain-wide policy specifying a relationship between the user group and the set of labeled entities, the relationship allowing users of the user group to access a service or a server represented by a labeled entity of the set; generating management instructions regulating communications between servers of the network domain based on the administrative domain-wide policy, with generating a first set of management instructions for the consumer server, the first set of management instructions configured to regulate communications between a user logged into the consumer server (130-p) and one or more labeled entities, with generating a second set of management instructions for the provider server (130q, 130r, 130s), the second set of management instructions configured to regulate communications between the provider server and one or more other servers, wherein each of the one or more other servers has at least a user logged in, wherein the user logged in belongs to a user group allowed to access the service provided by the provider server; and sending, to one or more servers, the management instructions to configure each of the one or more servers to implement the administrative domain-wide policy, by sending the first set of management instructions to the consumer server (130-p) and by sending the second set of management instructions to the provider server (130-q, 130-r, 130-s). receiving information describing one or more user groups, each user group containing one or more users associated with the network domain; receiving an association between the user group and a set of labeled entities, wherein a labeled entity is a service or a server (130p, 130q, 130,r, 130s), and wherein the set of labeled entities includes a service associated with a provider server (130q, 130r, 130s) and a consumer server, the association indicating that users of the user group are permitted to access the labeled entities of the set; determining an administrative domain-wide policy based on the received association, the administrative domain-wide policy specifying a relationship between the user group and the set of labeled entities, the relationship allowing users of the user group to access a service or a server represented by a labeled entity of the set; generating management instructions regulating communications between servers of the network domain based on the administrative domain-wide policy, with generating a first set of management instructions for the consumer server, the first set of management instructions configured to regulate communications between a user logged into the consumer server (130-p) and one or more labeled entities, with generating a second set of management instructions for the provider server (130q, 130r, 130s), the second set of management instructions configured to regulate communications between the provider server and one or more other servers, wherein each of the one or more other servers has at least a user logged in, wherein the user logged in belongs to a user group allowed to access the service provided by the provider server; and with generating a first set of management instructions for the consumer server, the first set of management instructions configured to regulate communications between a user logged into the consumer server (130-p) and one or more labeled entities, with generating a second set of management instructions for the provider server (130q, 130r, 130s), the second set of management instructions configured to regulate communications between the provider server and one or more other servers, wherein each of the one or more other servers has at least a user logged in, wherein the user logged in belongs to a user group allowed to access the service provided by the provider server; and sending, to one or more servers, the management instructions to configure each of the one or more servers to implement the administrative domain-wide policy, by sending the first set of management instructions to the consumer server (130-p) and by sending the second set of management instructions to the provider server (130-q, 130-r, 130-s).