A network device includes an initial data source to store configuration data for the network device, and a management module to generate a configuration patch that lists any differences between a working copy of the initial data source and the initial data source. The management module modifies the working copy based on configuration commands received from a client, and updates the initial data source in accordance with the differences defined by the configuration patch. During the update process, the management module verifies that any conditions specified by the patch are satisfied. The management module may generate the configuration patch in response to a first command from a client, and apply the patch in response to a second command from the client. The configuration patch may be communicated to other network devices for configuring the devices.