Network topology is an authority model

A network diagram also describes control: who can connect, who can change policy and where traffic is inspected.

Assign ownership

Name the team responsible for routing, access policy and shared services. Make exceptions visible and give them a review date.

A clear boundary should be understandable without reconstructing it from individual firewall rules.

Start with the communication the workloads need. Add shared connectivity only where there is a defined requirement.

Separate the ability to reach a service from the ability to use it. Keep application authentication and authorisation in the design.

Decide where traffic should be observed and where policy should be enforced. Avoid paths that quietly bypass those controls.

Check how the topology behaves when a shared component fails. Recovery should not depend on an undocumented route.

A new connection can change the reach of several workloads. Review its effect on the whole boundary, not only the requesting application.

Keep the diagram, deployed configuration and operating instructions aligned. Use connection tests to verify the intended result.