A service mesh enforces mutual TLS between workloads. What remains necessary?

1. Assuming every peer may read every record
2. Application authorization and workload access policies
3. Removal of all service identities
4. Disabling certificate rotation