Traffic flows that originate in a given zones are allowed to proceed to another zone based on the policy between the two zones. Grouping VPNs into zones allows you to establish security boundaries in your overlay network so that you can control all data traffic that passes between zones.
https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/sdwan-firewall-compliance- deploy-guide-2020sep.pdf