Patent ID: 8078707

Claim:
A method, performed by one or more devices, in a network including network devices, administrators, and objects, the method comprising: forming, by the one or more devices, a hierarchical tree of domains that semantically organize the network, each of the domains including logical groupings of the network devices, the administrators, or the objects; managing, by the one or more devices, the network based on the hierarchical tree of domains, where managing the network includes: determining that a first administrator, of the administrators, is attempting to perform an activity within a first domain of the domains in the hierarchical tree, performing a first determination of whether a first permission assigned to the first administrator in the first domain identifies the attempted activity, performing a second determination, when a result of the first determination does not identify the attempted activity, whether a second permission, assigned to the first administrator in a first parent domain to the first domain, identifies the attempted activity, where the first parent domain provides expressions corresponding to first pre-rules and first post-rules associated with the identified activity, and permitting, when a result of the second determination identifies the attempted activity, the first administrator to perform the identified activity within the first domain in the hierarchical tree, where a network device within the first domain includes a set of rules associated with the identified activity, and where a second parent domain, to which the first parent domain is a child, provides expressions corresponding to second pre-rules and second post-rules associated with the identified activity; and permitting, by the one or more devices, execution in order, by the network device within the first domain, of the second pre-rules, the first pre-rules, the set of rules, the first post-rules, and the second post rules.