A computer- implemented method comprising: obtaining reference concrete level rules for a node (102, 104) in a network, the obtaining including: obtaining a logical model (270A, 270B) for the network from a controller for the network, the logical model defining logical representations of network objects and their relationships; generating, based on the logical model for the network, a logical model for the node representing a portion of the logical model pertaining to the node; and generating, based on the logical model for the node, the reference concrete level rules for the node, the reference concrete level rules comprising access control rules; the method further comprising: obtaining, from the node in the network, implemented concrete level rules stored at the node, the implemented concrete level rules comprising access control rules implemented at the node; comparing the reference concrete level rules with the implemented concrete level rules; and determining that the implemented concrete level rules are not appropriately configured based on the comparing, the determining comprising identifying a mismatch between the reference concrete level rules and the implemented concrete level rules; wherein implemented concrete level rules are associated with hardware level entries stored in a memory of the node and wherein identifying a mismatch further comprises: identifying stale hardware level entries stored in the memory of the node; and performing one or more of: reporting the stale hardware level entries to a network administrator; and removing the stale hardware level entries. obtaining reference concrete level rules for a node (102, 104) in a network, the obtaining including: obtaining a logical model (270A, 270B) for the network from a controller for the network, the logical model defining logical representations of network objects and their relationships; generating, based on the logical model for the network, a logical model for the node representing a portion of the logical model pertaining to the node; and generating, based on the logical model for the node, the reference concrete level rules for the node, the reference concrete level rules comprising access control rules; obtaining a logical model (270A, 270B) for the network from a controller for the network, the logical model defining logical representations of network objects and their relationships; generating, based on the logical model for the network, a logical model for the node representing a portion of the logical model pertaining to the node; and generating, based on the logical model for the node, the reference concrete level rules for the node, the reference concrete level rules comprising access control rules; the method further comprising: obtaining, from the node in the network, implemented concrete level rules stored at the node, the implemented concrete level rules comprising access control rules implemented at the node; comparing the reference concrete level rules with the implemented concrete level rules; and determining that the implemented concrete level rules are not appropriately configured based on the comparing, the determining comprising identifying a mismatch between the reference concrete level rules and the implemented concrete level rules; wherein implemented concrete level rules are associated with hardware level entries stored in a memory of the node and wherein identifying a mismatch further comprises: identifying stale hardware level entries stored in the memory of the node; and performing one or more of: reporting the stale hardware level entries to a network administrator; and removing the stale hardware level entries. obtaining, from the node in the network, implemented concrete level rules stored at the node, the implemented concrete level rules comprising access control rules implemented at the node; comparing the reference concrete level rules with the implemented concrete level rules; and determining that the implemented concrete level rules are not appropriately configured based on the comparing, the determining comprising identifying a mismatch between the reference concrete level rules and the implemented concrete level rules; wherein implemented concrete level rules are associated with hardware level entries stored in a memory of the node and wherein identifying a mismatch further comprises: identifying stale hardware level entries stored in the memory of the node; and performing one or more of: reporting the stale hardware level entries to a network administrator; and removing the stale hardware level entries. reporting the stale hardware level entries to a network administrator; and removing the stale hardware level entries.