diff --git a/plstackapi/core/admin.py b/plstackapi/core/admin.py
index e332c29..d43a500 100644
--- a/plstackapi/core/admin.py
+++ b/plstackapi/core/admin.py
@@ -157,16 +157,16 @@
 
     def save_model(self, request, obj, form, change):
         # update openstack connection to use this site/tenant   
-        client = OpenStackClient(tenant=obj.site.login_base, **request.session.get('auth', {}))
-        obj.driver = OpenStackDriver(client=client)
-        obj.caller = request.user
+        auth = request.session.get('auth', {})
+        auth['tenant'] = obj.site.login_base
+        obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
         obj.save()
 
     def delete_model(self, request, obj):
         # update openstack connection to use this site/tenant   
-        client = OpenStackClient(tenant=obj.site.login_base, **request.session.get('auth', {}))
-        obj.driver = OpenStackDriver(client=client)
-        obj.caller = request.user
+        auth = request.session.get('auth', {})
+        auth['tenant'] = obj.site.login_base
+        obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
         obj.delete()
 
 class KeyAdmin(OSModelAdmin):
@@ -195,9 +195,9 @@
             if obj is None:
                 continue
             # give inline object access to driver and caller
-            client = OpenStackClient(tenant=obj.name, **request.session.get('auth', {}))
-            inline.model.driver = OpenStackDriver(client=client)
-            inline.model.caller = request.user
+            auth = request.session.get('auth', {})
+            auth['tenant'] = obj.name       # meed to connect using slice's tenant
+            inline.model.os_manager = OpenStackManager(auth=auth, caller=request.user)
             yield inline.get_formset(request, obj)
 
     def get_queryset(self, request):
@@ -214,19 +214,20 @@
     list_display = ('user', 'slice', 'role')
 
     def save_model(self, request, obj, form, change):
-        # update openstack connection to use this slice/tenant
-        client = OpenStackClient(tenant=obj.slice.name, **request.session.get('auth', {}))
-        obj.driver = OpenStackDriver(client=client)
-        obj.caller = request.user
+        # update openstack connection to use this site/tenant
+        auth = request.session.get('auth', {})
+        auth['tenant'] = obj.slice.name
+        obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
         obj.save()
 
     def delete_model(self, request, obj):
-        # update openstack connection to use this slice/tenant
-        client = OpenStackClient(tenant=obj.slice.name, **request.session.get('auth', {}))
-        obj.driver = OpenStackDriver(client=client)
-        obj.caller = request.user
+        # update openstack connection to use this site/tenant
+        auth = request.session.get('auth', {})
+        auth['tenant'] = obj.slice.name
+        obj.os_manager = OpenStackManager(auth=auth, caller=request.user)
         obj.delete()
 
+
 class SubnetAdmin(PlanetStackBaseAdmin):
     fields = ['cidr', 'ip_version', 'start', 'end', 'slice']
     list_display = ('slice','cidr', 'start', 'end', 'ip_version')
diff --git a/plstackapi/core/models/site.py b/plstackapi/core/models/site.py
index 2c60e16..f23ef3f 100644
--- a/plstackapi/core/models/site.py
+++ b/plstackapi/core/models/site.py
@@ -39,11 +39,11 @@
     def __unicode__(self):  return u'%s %s %s' % (self.site, self.user, self.role)
 
     def save(self, *args, **kwds):
-        self.driver.add_user_role(self.user.user_id, self.site.tenant_id, self.role.role_type)
+        self.os_manager.driver.add_user_role(self.user.user_id, self.site.tenant_id, self.role.role_type)
         super(SitePrivilege, self).save(*args, **kwds)
 
     def delete(self, *args, **kwds):
-        self.driver.delete_user_role(self.user.user_id, self.site.tenant_id, self.role.role_type)
+        self.os_manager.driver.delete_user_role(self.user.user_id, self.site.tenant_id, self.role.role_type)
         super(SitePrivilege, self).delete(*args, **kwds)
 
 
diff --git a/plstackapi/core/models/slice.py b/plstackapi/core/models/slice.py
index 16a2c27..d509cc0 100644
--- a/plstackapi/core/models/slice.py
+++ b/plstackapi/core/models/slice.py
@@ -28,42 +28,11 @@
     def __unicode__(self):  return u'%s' % (self.name)
 
     def save(self, *args, **kwds):
-        if not self.tenant_id:
-            nova_fields = {'tenant_name': self.name,
-                   'description': self.description,
-                   'enabled': self.enabled}
-            tenant = self.driver.create_tenant(**nova_fields)
-            self.tenant_id = tenant.id
-
-            # give caller an admin role at the tenant they've created
-            self.driver.add_user_role(self.caller.user_id, tenant.id, 'admin')
-
-            # refresh credentials using this tenant
-            self.driver.shell.connect(username=self.driver.shell.keystone.username,
-                                      password=self.driver.shell.keystone.password, 
-                                      tenant=tenant.name) 
-
-            # create network
-            network = self.driver.create_network(self.name)
-            self.network_id = network['id']
-
-            # create router
-            router = self.driver.create_router(self.name)
-            self.router_id = router['id']
-
-        if self.id:
-            self.driver.update_tenant(self.tenant_id,
-                                      description=self.description,
-                                      enabled=self.enabled)
-
+        self.os_manager.save_slice(self)
         super(Slice, self).save(*args, **kwds)
 
     def delete(self, *args, **kwds):
-        if self.tenant_id:
-            self.driver.delete_router(self.router_id)
-            self.driver.delete_network(self.network_id)
-            self.driver.delete_tenant(self.tenant_id)
-
+        self.os_manager.delete_slice(self)
         super(Slice, self).delete(*args, **kwds)    
 
 class SliceMembership(PlCoreBase):
@@ -74,9 +43,9 @@
     def __unicode__(self):  return u'%s %s %s' % (self.slice, self.user, self.role)
 
     def save(self, *args, **kwds):
-        self.driver.add_user_role(self.user.user_id, self.slice.tenant_id, self.role.role_type)
+        self.os_manager.driver.add_user_role(self.user.user_id, self.slice.tenant_id, self.role.role_type)
         super(SliceMembership, self).save(*args, **kwds)
 
     def delete(self, *args, **kwds):
-        self.driver.delete_user_role(self.user.user_id, self.slice.tenant_id, self.role.role_type)
+        self.os_manager.driver.delete_user_role(self.user.user_id, self.slice.tenant_id, self.role.role_type)
         super(SliceMembership, self).delete(*args, **kwds)
diff --git a/plstackapi/openstack/manager.py b/plstackapi/openstack/manager.py
index 9cf7652..c0af4ef 100644
--- a/plstackapi/openstack/manager.py
+++ b/plstackapi/openstack/manager.py
@@ -93,6 +93,43 @@
         if site.tenant_id:
             self.driver.delete_tenant(site.tenant_id)
                
+    @require_enabled
+    def save_slice(self, slice):
+        if not slice.tenant_id:
+            nova_fields = {'tenant_name': slice.name,
+                   'description': slice.description,
+                   'enabled': slice.enabled}
+            tenant = self.driver.create_tenant(**nova_fields)
+            slice.tenant_id = tenant.id
+
+            # give caller an admin role at the tenant they've created
+            self.driver.add_user_role(self.caller.user_id, tenant.id, 'admin')
+
+            # refresh credentials using this tenant
+            self.driver.shell.connect(username=self.driver.shell.keystone.username,
+                                      password=self.driver.shell.keystone.password,
+                                      tenant=tenant.name)
+
+            # create network
+            network = self.driver.create_network(slice.name)
+            slice.network_id = network['id']
+
+            # create router
+            router = self.driver.create_router(slice.name)
+            slice.router_id = router['id']
+
+        if slice.id and slice.tenant_id:
+            self.driver.update_tenant(slice.tenant_id,
+                                      description=slice.description,
+                                      enabled=slice.enabled)    
+
+    @require_enabled
+    def delete_slice(self, slice):
+        if slice.tenant_id:
+            self.driver.delete_router(slice.router_id)
+            self.driver.delete_network(slice.network_id)
+            self.driver.delete_tenant(slice.tenant_id)
+
     def refresh_nodes(self):
         # collect local nodes
         nodes = Node.objects.all()