31. A system for enabling a network manager to control usage of network resources on a communications network based on the identity of an authenticated user, the system comprising: a rule editing module enabling the network manager to edit one or more packet rules for analyzing packets received at one or more devices of the communications network, each rule including a condition and action to be taken if a packet received at a device satisfies the condition; a service editing module enabling the network manager to edit one or more service abstractions, each service abstraction representing a communications network service to be provided to users of the communications network, each service abstraction including a named set of one or more of the packet rules that, in combination, provide the represented communications network service; a user management module enabling the network manager to associate users of the communications network with one or more of the service abstractions; storage means comprising memory for storing one or more of the service abstractions, one or more of the packet rules or one or more of the associations between users of the communications network and one or more of the service abstractions; and a role editing module enabling the network manager to edit one or more role abstractions, each role abstraction representing a role of users with respect to the communications network, and each role abstraction including a set of one or more service abstractions representing communications network services to be provided to users associated with the represented role, and wherein the user management module further enables the network manager to associate users of the communications network with one or more of the role abstractions.
34. The system of claim 31 , further comprising: a distribution module to distribute the one or more role abstractions to one or more network devices residing on the communications network.