For a long time, internal was a boundary.

If traffic stayed inside the network perimeter, if services talked over RFC 1918 address space, if access required VPN tunnels or corporate SAML assertions—we treated it as lower risk. Not risk-free. Just understood. The kind of understood where you'd grant broader permissions, skip TLS mutual...