26. A method of controlling usage of network resources on a communications network based on the identity of an authenticated user, the method comprising acts of: creating, with at least one computer, one or more packet rules for analyzing packets received at one or more network devices of the communications network, each rule including a condition and action to be taken as part of providing a service of the communications network if a packet received at a device satisfies the condition, wherein the one or more packet rules are defined to examine any portion of a packet; storing, with at least one computer, the one or more packet rules; creating, with at least one computer, one or more service abstractions, each service abstraction representing a communications network service to be provided to users of the communications network, each service abstraction including a named set of one or more of the packet rules that, in combination, provide the represented communications network service; storing, with at least one computer, the one or more service abstractions; associating, by at least one computer and by the one or more service abstractions, with the identity of the authenticated user of the communications network; in response to receipt of a packet at any of the network devices from the authenticated user, using, by one of the network devices, the one or more service abstractions associated with the identity of the authenticated user to control usage of network resources on the communications network, the using including applying the packet rules in the one or more service abstractions to the packet; and creating, with at least one computer, one or more role abstractions, each role abstraction representing a role of users with respect to the communications network, and each role abstraction including a set of one or more service abstractions representing communications network services to be provided to users associated with the represented role, and wherein the act of associating one or more service abstractions with the identity of the authenticated user includes associating the identity of the authenticated user with one or more of the role abstractions.
26. A method of controlling usage of network resources on a communications network based on the identity of an authenticated user, the method comprising acts of: creating, with at least one computer, one or more packet rules for analyzing packets received at one or more network devices of the communications network, each rule including a condition and action to be taken as part of providing a service of the communications network if a packet received at a device satisfies the condition, wherein the one or more packet rules are defined to examine any portion of a packet; storing, with at least one computer, the one or more packet rules; creating, with at least one computer, one or more service abstractions, each service abstraction representing a communications network service to be provided to users of the communications network, each service abstraction including a named set of one or more of the packet rules that, in combination, provide the represented communications network service; storing, with at least one computer, the one or more service abstractions; associating, by at least one computer and by the one or more service abstractions, with the identity of the authenticated user of the communications network; in response to receipt of a packet at any of the network devices from the authenticated user, using, by one of the network devices, the one or more service abstractions associated with the identity of the authenticated user to control usage of network resources on the communications network, the using including applying the packet rules in the one or more service abstractions to the packet; and creating, with at least one computer, one or more role abstractions, each role abstraction representing a role of users with respect to the communications network, and each role abstraction including a set of one or more service abstractions representing communications network services to be provided to users associated with the represented role, and wherein the act of associating one or more service abstractions with the identity of the authenticated user includes associating the identity of the authenticated user with one or more of the role abstractions. 29. The method of claim 26 , further comprising an act of: distributing, with at least one computer, the one or more role abstractions to one or more network devices residing on the communications network.