As also a security person (:wave:), you can use dedicated node pools and workload identity to isolate workloads in the same cluster.