It might be worth checking out Canonical's Juju, we're working on deployable segregation (like security groups) defined in code!