Solaris 10 - Is zone isolation sufficient for segregating high and low security servers?

Let's consider the typical scenario of a Web application that has a web server, application server and database server. All servers are located in different network zones separated by firewalls. From the security point of view, is it possible to install all the three servers as Solaris 10 zones on the same physical server? Do Solaris zones have security mecanisms to isolate servers to make sure that a compromised Web server could not affect other servers?