In action 408, authorizing access to a set of operations on the virtual object, for the party, may be performed, wherein the operations are based on the specific role of the party, in a hierarchy of party roles.

The hierarchy of party roles may comprise a hierarchy of one or more user roles and one or more administrator roles.

The set of operations may comprise any one of: allocating a VNF, performing a network or storage request, and updating or querying an allocated resource.

Separation of duty may be applied to the hierarchy of party roles comprising the specific role of the party based on which operations on the virtual object, are authorized access to.

Obtaining NS instance information may comprise allocating NS instance information from the NFVO or from the VNF manager.

The virtual object being allocated to the SD may comprise any one of: a virtual link, a VNF, a VNF component, a VNF component instance, a virtual storage, a virtual machine, a virtual machine image, vTap and vFEP.

According to one scenario A, further action may be performed.

Action 410: A resource selection input may be received from the NFVO or the VNF manager, said resource selection input having a location attribute of a resource.

In action 412 it is then determined whether the location attribute indicate a location within a geographic location information of the NS instance information, or not.

Action 414: If action 412 is answered with a “Yes”, i.e. that the location attribute indicates a location within geographic location information of the NS instance, it is allowed to allocate the resource to a VNF of the NS.