Walk me through how you would design a network policy to isolate a sensitive scientific workload within a multi-tenant Kubernetes cluster.
