Policy declarations for cloud management system

A method to prevent violations of policies declared in a system that monitors a network of virtual machines, the method comprising:

• converting, by executing an instruction with a processor, network state data received from a plurality of data sources into a set of relational tables including a first table storing data corresponding to logical networks and a second table storing data corresponding to virtual machines and a third table storing data corresponding to storage networks, the network state data representative of a state of the network of the virtual machines determined by the respective data sources;
• in response to detecting a request to modify the network state data, storing a copy of the network state data in network state tables in temporary memory;
• modifying, by executing an instruction with the processor, the copy of the network state data to simulate the requested modification of the network state data by changing the network state tables corresponding to the requested modification;
• detecting, by executing an instruction with a processor, within the copy of the network state data, a network state violation of a data source of the plurality of data sources according to a declaration of a policy that specifies a set of conditions for a particular set of network state entities received from at least two of the data sources, the set of conditions specified as an existence of a set of data tuples involving the set of network state entities in the stored set of relational tables;
• and in response to detecting the network state violation, executing an action to modify the particular set of network state entities so that the data source is no longer in violation of the declaration of the policy, the action including executing an application programming interface call to prevent a virtual machine of the data source from connecting to the network to prevent the network state violation.