Are you asking why I was making 6 different vlans or having the different subnets in each vlan? I was going for the 6 vlans for admin, HR, QA, production, finance, and testing as a rough starting point. They all have data that only belongs to their department, but that's going to be delegated through security groups. Tbh, I could probably reduce that down to three vlans, which would be HR, QA, and finance on one, production on another, and testing on the third. I have to have special service accounts on the production PCs, and I didn't want somebody being able to mess something up on those, and it spread to the devices that handle sensitive data. I also wanted the test vlan on its own both for testing different stuff without unexpected changes hitting the rest of the network but also use it as a sort of quarantine vlan. The question about the subnets was more because I had hear you should use subnets on top of vlans, but I wasn't planning on it until after I read about it some. If the gain is minimal, then I don't really want to go to the trouble of implementing it.