Network virtualization infrastructure with divided user responsibilities

A non-transitory machine-readable medium storing a network manager program which when executed by at least one processing unit manages one or more logical networks, the network manager program comprising sets of instructions for:

• from a first user, receiving a definition of one or more security zones for a logical network, each security zone definition comprising a set of security rules for data compute nodes (DCNs) assigned to the security zone;
• from a second user, receiving a definition of an application to be deployed in the logical network, the application definition specifying a set of requirements;
• and
• based on the specified set of requirements, assigning DCNs implementing the application to one or more of the security zones for the logical network.