An organization's security architecture team is designing a secure AI inference infrastructure where the AI model inference API must only be accessible to a specific set of microservices within a Kubernetes cluster, and not to any other workloads. Which Zero Trust network control pattern achieves this microsegmentation?

Using Kubernetes Network Policies to restrict egress from only the authorized microservice pods to the AI inference endpoint, and block all other pods, is correct because it provides pod-level microsegmentation within a cluster. By defining an egress policy that allows only pods with specific labels, the authorized microservice pods, to reach the AI inference endpoint IP/FQDN, all other pods in the cluster are blocked from accessing the AI service—even on the same node or namespace. This implements Zero Trust at the workload level. Deploying Azure Firewall and creating application rules allowing only the AI inference API FQDN is wrong because Azure Firewall with FQDN rules applies to traffic leaving the VNet, not to intra-cluster pod-to-pod or pod-to-endpoint restrictions. Configuring an Azure NSG on the subnet allowing only port 443 from the cluster VNet is wrong because an NSG on the subnet restricts access to that subnet broadly but cannot differentiate between individual pods within the same subnet. Implementing Azure Private Endpoint for the AI service with access restricted to the cluster subnet is wrong because the private endpoint restricts access at the subnet level, not at the pod level; once the cluster subnet is allowed, all pods in that subnet can still reach the private endpoint unless Kubernetes Network Policies or another pod-level control is also applied.