Segmentation

Objective

Allow private access only where explicitly required.

Steps

1. Assign devices to dedicated egress IDs.
2. Add private routes to selected tunnels.
3. Add explicit client-acls for management paths only.

This keeps default posture closed and auditable.