Declarative security management plugins

A method, comprising:

• transmitting, by a client of a client-server system, a service plugin package to a validation system via the network;
• validating, by the client, the service plugin package utilizing the validation system;
• receiving, by the client, a validation indicator that indicates whether the service plugin package is valid from the validation system;
• when the validation indicator indicates that the service plugin package is valid, transmitting, by the client, the service plugin package to a runtime server via the network,
• after transmitting the service plugin package, transmitting, by the client, client service data associated with a set of extension declarations of the service plugin package using a client service plugin of the service plugin package over the network;
• receiving, by a runtime server of the client-server system the service plugin package from the network;
• accessing, by the runtime server, a first set of management services;
• identifying, by the runtime server and for each management service of the first set of management services, a subset of the set of extension declarations of the service plugin package that are supported by the management service;
• adding, by the runtime server and for each management service of the first set of management services, a respective subset of the set of extension declarations to the respective management service that supports the respective subset of the set of extension declarations, each extension declaration of the set of extension declarations including i) grouping information that describes how the extension declaration is to be grouped within an existing set of extension declarations of the first set of the management services, and ii) ordering information that describes how the extension declaration is to be ordered within a particular grouping of extension declarations of the first set of the management services;
• receiving, by the runtime server, the client service data from the client via the network;
• and
• providing, by the runtime server, a first management service of the first set of management services for the client based on the client service data and a first subset of the set of extension declarations corresponding to the first management service,
• wherein the first subset of the set of extension declarations specifies how the first management service is provided to the client.