Segmentation becomes manageable when trust boundaries are derived from business function rather than switch location. Treat VLANs as local transport and VRFs as durable routing boundaries.
Boundary model
Document users, devices, permitted flows, inspection points, address ownership, and failure behavior for every segment.