Mission Essential Data Flow Function

Bus traffic replay has the same precondition as bus traffic spoofing: an unpartitioned path from the replaying node to the subscriber. Domain separation narrows the path; anti-replay authentication, not this practice, closes it.

Forging bus messages with valid identifiers depends on any node being able to emit any message. Domain separation for on-board communications constrains which nodes may originate which traffic, which narrows the technique without authenticating the messages themselves.

The host-payload gateway is a domain boundary, and least privilege across it is what keeps a payload from exercising bus functions it has no mission need for.

The technique is defined by the absence of bus partitioning; the practice mandates domain separation for the on-board architecture, communications, and control. This is the architectural counterpart to MI-AUTH-01's access-mediation reading of the same technique: one requires the separation, the other the gate that enforces it.

Escaping a virtualised partition to reach the host is the failure mode domain separation exists to prevent, and the practice requires domain separation for the on-board architecture. Moderate rather than high because the practice states the principle rather than the enforcement mechanism whose defect the escape exploits.