A security team discovers that after a single compromised application server in the web tier, an attacker was able to reach and pivot to database servers, internal APIs, and a logging service — all within the same subnet. The workloads all reside in one flat network segment. The team wants to limit the blast radius of any future compromise so that a breached workload cannot freely communicate with unrelated workloads. Which approach BEST addresses this requirement?