Patent ID: 8495721

Claim:
A method comprising: assigning a first security level to a first group of one or more individuals wherein the first security level allows the first group of one or more individuals to change policy definitions that delineate regulation of data network traffic to be implemented by a network security mechanism and policy token definitions that delineate tokens used in the policy definitions wherein the policy token definitions each comprise a keyword that identifies a characteristic of the functionality of a defined policy term and a token that is associated with the keyword and applied to the characteristic of the functionality identified by the keyword; assigning a second security level to a second group of one or more individuals wherein the second security level allows the second group of one or more individuals to change the policy token definitions while restricting the second group of one or more individuals from changing the policy definitions; assigning a third security level to a third group of one or more individuals wherein the third security level prevents the third group of one or more individuals from changing either the policy token definitions or the policy definitions; receiving a request to change a first policy definition of the policy definitions; determining that an individual associated with the request has been assigned the first security level; based on the determining, translating the first policy definition using one or more translation rules from a device-agnostic policy to a plurality of different device-specific policies; providing each of the device-specific policies to a respective device; and wherein assigning, receiving, determining and providing are performed by one or more computers.