1. A method for determining an access control rule authorizing communication between a plurality of managed servers within an administrative domain, the method comprising: obtaining communication information describing past communication between the plurality of managed servers; identifying a subset of managed servers from the plurality of managed servers by grouping the plurality of managed servers based on the obtained communication information; determining a group-level label set to associate with the subset of managed servers; determining role labels for managed servers in the subset of managed servers, a managed server associated with one role label; generating, based on the group-level label set and the role labels, an access control rule authorizing communication between a first managed server of the subset of managed servers and a second managed server; and storing the access control rule as part of an administrative domain-wide management policy.