A number of configuration elements are associated with a number of devices. Information about input configuration elements is accessed. An input configuration element is associated with one or more input rules. It is determined which of the configuration elements could be accessed by the input rules and any call chains emanating from the rules. Output rules are determined by using the accessed configuration elements, the input rules, and the way the input rule manipulates its accessed configuration elements. Each output rule may be derived from an input rule and corresponds to the same input configuration element associated with that input rule. An executable module is generated that is adapted to access at least a given one of the input configuration elements and to trigger one or more of the output rules corresponding to the given input configuration element. Read and write sets for rules are determined, and the triggered output rules ensure that restrictions associated with a configuration element are not violated