1. A method for determining access control rules authorizing communication between a plurality of managed servers within an administrative domain, the method comprising: obtaining communication information describing past communication between the plurality of managed servers; identifying server groups each containing a subset of managed servers from the plurality of managed servers by grouping the plurality of managed servers based on the obtained communication information; assigning a group-level label set to the subset of managed servers in each server group, the group-level label set containing one or more group-level labels describing the managed servers in the server group; assigning role labels to individual managed servers within each server group, wherein a role label assigned to an individual managed server is determined based on information about the individual managed server; identifying in the communication information a communication between a first managed server and a second managed server, the first managed server assigned a first group-level label and role label pair, the second managed server assigned a second group-level label and role label pair; generating an access control rule authorizing communications between the first managed server and the second managed server, wherein the generated access control rule further authorizes communication between other managed servers assigned the first group-level label and role label pair and other managed servers assigned the second group-level label and role label pair; and storing the access control rule as part of an administrative domain-wide management policy.