1. For a system that monitors a network to prevent violations of network policies, a method comprising: storing network state data that describes the network; identifying that a first set of stored network state data violates a particular policy declared for the network; issuing a command to a first cloud management application to modify the network state data such that the modified network state data does not violate the particular policy; determining whether a requested action that modifies a second set of network state data, received from a second cloud management application, violates any policies; and responding to the second cloud management application to (i) permit the requested change when the modified second set of network state data does not violate any policies and (ii) deny the requested change when the modified second set of network state data violates the particular policy.