How outbound-only tunnels, identity-aware access policies, and device posture replace flat VPN network access.