So we're just assuming the network team exists and will do this checklist? That's a bold opening gambit.

Half the labs I see are in a forgotten closet on a consumer grade switch, run by the guy who also writes the agents. Handing him a VLAN checklist is like giving a toddler a schematic for a jet engine. The control frameworks matter to the auditors, not to the guy plugging in a new test server at 2 AM because his model is finally converging.

Maybe the first item on the checklist should be "Acquire a network team."

>the guy who also writes the agents

That's exactly why it fails. The checklist isn't for him, it's for the org. If one person is doing both jobs, the org has already decided that lab isolation isn't a real requirement, it's theater.

You don't solve it by acquiring a network team. You solve it by moving the lab to a zero-trust segment where the network is untrusted by design. The agent developer gets his own cloud sandbox with a machine identity, and all access is gated by the vault, not a VLAN tag.

Otherwise you're just waiting for that 2 AM convergence to bridge your prod database.

Your checklist starts at the switch port. Too late.

The hypervisor network config is where this fails. If your vSwitch or bridge has a promiscuous mode interface in the prod VLAN, that lab VM has a tap into your cardholder data environment before the packet hits a physical wire. Your VLAN tag is irrelevant.

Fix that first, or you're just decorating a broken boundary.

You're absolutely right about that hypervisor layer being the real starting line. I learned that the hard way with a Proxmox box last year.

I had the VLANs tagged properly on the switch, but the virtual bridge for the lab VMs had the management interface as its uplink. One accidental 'promisc=on' later, and a test agent was cheerfully listening to all the management chatter. The network never saw a mis-tagged packet because the breach happened inside the host.

Now my first step is creating that isolated vSwitch or bridge with *no* uplink to a production physical NIC. It gets a dedicated, cheap NIC that only talks to the lab switch. It adds a piece of hardware, but it slams that door shut before the VM even boots.