1. A method comprising: by a network device, determining a service profile from one or more authentication messages received by the network device that include the service profile, wherein the network device is intermediately positioned in a service provider network between a customer network and a centralized network device that provides a hierarchical arrangement of virtual local area networks (VLANs) over which traffic to and from the customer network for one or more services is delivered, wherein the hierarchical arrangement of VLANs includes a customer VLAN (C-VLAN) that is tunneled through a service VLAN (S-VLAN), wherein the C-VLAN is terminated at the customer network and the centralized network device that provides the hierarchical arrangement of VLANs, wherein the intermediately positioned network device is connected to the centralized network device via the S-VLAN in which the intermediately positioned network device tunnels the C-VLAN through the S-VLAN with a plurality of other C-VLAN in a manner that aggregates the C-VLAN with the plurality of other C-VLANs; associating, with the intermediately positioned network device, the service profile with a first VLAN tag for the C-VLAN and a second VLAN tag for the S-VLAN in the hierarchical arrangement of VLANs used for delivering the traffic to and from the customer network and the service provider network, wherein the service profile defines constraints on delivery of the traffic associated with the one or more services sent to and received by the customer network; and applying the service profile with the intermediately positioned network device to the traffic received via the associated hierarchical arrangement of VLANs when the traffic is tagged with the first VLAN tag and the second VLAN tag to enforce the constraints on the delivery of the traffic received via the associated hierarchical arrangement of VLANs.