A method for managing data traffic within a network, said network comprising a plurality of controllers, each of said controllers controlling a part of the network, said network parts comprising at least one forwarding element, 'FE', for forwarding data within said network, and wherein each of said controllers is connected to at least one reference monitor, 'RM' for enforcing a security policy for the network part managed by said controller, comprising the steps of: a) Receiving a rule request by a controller and transmitting it to its RM, b) Checking said rule request by said RM for policy compliance, c) Authorizing a part of the rule request which is policy compliant by said RM, and Wherein when said rule request comprises an outside modification, an outside modification impacting at least one other network part not managed by said controller, d) Said controller contacts at least the one or more controllers being impacted by said outside modification for obtaining an authorization for said outside modification, e) Upon reception of said one or more authorizations for said outside modification, sending all modifications of said rule request and corresponding authorizations by said controller to all other controllers being impacted by said rule request for implementing said modification in their one or more forwarding elements. said network comprising a plurality of controllers, each of said controllers controlling a part of the network, said network parts comprising at least one forwarding element, 'FE', for forwarding data within said network, and wherein each of said controllers is connected to at least one reference monitor, 'RM' for enforcing a security policy for the network part managed by said controller, comprising the steps of: a) Receiving a rule request by a controller and transmitting it to its RM, b) Checking said rule request by said RM for policy compliance, c) Authorizing a part of the rule request which is policy compliant by said RM, and Wherein when said rule request comprises an outside modification, an outside modification impacting at least one other network part not managed by said controller, d) Said controller contacts at least the one or more controllers being impacted by said outside modification for obtaining an authorization for said outside modification, e) Upon reception of said one or more authorizations for said outside modification, sending all modifications of said rule request and corresponding authorizations by said controller to all other controllers being impacted by said rule request for implementing said modification in their one or more forwarding elements. a) Receiving a rule request by a controller and transmitting it to its RM, b) Checking said rule request by said RM for policy compliance, c) Authorizing a part of the rule request which is policy compliant by said RM, and d) Said controller contacts at least the one or more controllers being impacted by said outside modification for obtaining an authorization for said outside modification, e) Upon reception of said one or more authorizations for said outside modification, sending all modifications of said rule request and corresponding authorizations by said controller to all other controllers being impacted by said rule request for implementing said modification in their one or more forwarding elements. <EOS>