Network virtualization infrastructure with divided user responsibilities

A non-transitory machine-readable medium storing a network manager program which when executed by at least one processing unit manages one or more logical networks, the network manager program comprising sets of instructions for:

• from a provider first user of the network management and control system, receiving a definition of a first set of one or more security zones for a logical network, each security zone definition comprising a set of security rules for data compute nodes (DCNs) assigned to the security zone, wherein the provider first user defines a plurality of tenant users of the network management and control system;
• from a tenant second user of the network management and control system that is one of the plurality of tenant users defined by the provider first user and that manages networking and security configurations for at least a portion of the logical network, receiving a definition of a second set of security zones for the logical network;
• from an application developer third user of the network management and control system, receiving a definition of an application to be deployed in the logical network, the application definition specifying a set of security requirements for the application;
• and
• based on the specified set of security requirements, assigning DCNs implementing the application to one or more of the security zones of the first and second sets of security zones for the logical network.