A computer-implemented method for determining an access control rule authorizing communication between a plurality of managed servers (130A, 130B) within an administrative domain, the method being executed by a global manager communicatively coupled with the plurality of managed servers (130A, 130B), the method comprising: obtaining communication information describing past communication between pairs of managed servers of the plurality of managed servers (130A, 130B); identifying a server group containing a subset of managed servers from the plurality of managed servers by grouping the plurality of managed servers based on the obtained communication information; wherein the grouping comprises: constructing a graph where the nodes represent managed servers of the administrative domain and where the values of the edges represent the volume of communication between managed servers; and partitioning the graph into sub-graphs, each sub-graph corresponding to an application group, wherein the server group is one application group; assigning a set of group-level labels to the subset of managed servers in the server group, the group-level label set containing group-level labels associated with the servers in the server group; assigning role labels to individual managed servers within the group, wherein a role label associated with a managed server is determined based on hardware resources, service information, or other managed server information; generating, based on the group-level label set and role labels, an access control rule authorizing communications between pairs of managed servers in the plurality of managed servers; and storing the access control rule as part of an administrative domain-wide management policy. obtaining communication information describing past communication between pairs of managed servers of the plurality of managed servers (130A, 130B); identifying a server group containing a subset of managed servers from the plurality of managed servers by grouping the plurality of managed servers based on the obtained communication information; wherein the grouping comprises: constructing a graph where the nodes represent managed servers of the administrative domain and where the values of the edges represent the volume of communication between managed servers; and partitioning the graph into sub-graphs, each sub-graph corresponding to an application group, wherein the server group is one application group; constructing a graph where the nodes represent managed servers of the administrative domain and where the values of the edges represent the volume of communication between managed servers; and partitioning the graph into sub-graphs, each sub-graph corresponding to an application group, wherein the server group is one application group; assigning a set of group-level labels to the subset of managed servers in the server group, the group-level label set containing group-level labels associated with the servers in the server group; assigning role labels to individual managed servers within the group, wherein a role label associated with a managed server is determined based on hardware resources, service information, or other managed server information; generating, based on the group-level label set and role labels, an access control rule authorizing communications between pairs of managed servers in the plurality of managed servers; and storing the access control rule as part of an administrative domain-wide management policy.