How should network segmentation and private connectivity be designed for production in Cloud Security?

Use private connectivity where practical, deny by default, segment trust zones, control egress, and log network decisions. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.