Any app in the DMZ is at best only semi-trusted. Ideally apps in the DMZ should have NO reach into the internal network, data should be pushed not pulled so firewalls only need to open from the more secure to the less secure network not the other way around.
If that is not possible for some reason (and it would have to be a really good reason!), you need to make absolutely certain that the DMZ app has the minimum possible access to anything.
In addition, you don't really even want anything reaching out if you can avoid it. Every connection is a potential risk.
In most cases, you would even create a parallel network for management traffic so that you can further limit and reduce the available attack windows.
Blocking Insider Threats
Restricting internal networks to block insider threats is a sensible idea but don't loose sight of the value of your data and the relative risks involved. Most forms of security come with some cost maybe $$$ but maybe in admin overheads and user overheads so be sensible.
Having said that, it is very important to separate assets of differing values and security. So high security data such as your core PKI infrastructure or patient records, etc. should be kept separate from less important data such as management information perhaps (depends on your business). Segmenting data in this way can actually reduce costs in some cases because, even though the infrastructure and admin costs may be higher, the physical protection costs overall may be less than having to protect everything.
There isn't really a one-size-fits-all solution for this.
One other consideration. Internal controls are by no means just about stopping insider threats. Remember that most intrusions to large enterprise data lie undiscovered for 12m or more and often are only discovered by external parties. It is common practice for the bad guys to break into something innocuous and then slowly work their way up the food chain, keeping below the intrusion detection radar all the way.