Abstract: Network elements at endpoints of a data connection are identified. A network path is generated between the network elements at the endpoints. The network path is validated by determining whether the network path provides at least one service requirement. The service requirement may be a minimum bandwidth requirement, a maximum bandwidth requirement, a maximum delay requirement, a maximum jitter requirement, a reliability requirement, a requirement that the network path includes network elements capable of acting as security gateways that bracket untrusted sections of the network path, a reachability requirement, or a data collection capability requirement. Network elements along a validated network path are configured to implement the service requirement. In one embodiment, the configuration performed on the network elements is recorded.