Define trust boundaries
Map which workloads may communicate, which services are public, which routes must remain private and how administrative access is controlled. Network design should follow approved traffic flows instead of expanding ad hoc after launch.
Treat secrets as infrastructure
Store credentials in managed secret systems, define rotation ownership and grant the smallest practical scope. Production secrets should never be embedded in source repositories, container images or client-side bundles.
Plan evidence and recovery
Logging and backup design should answer two different questions: can we understand what happened, and can we recover safely when something fails?