Boundary Protection Function

Same boundary reasoning as LM-0003 from the access side: the practice constrains what crosslink-delivered traffic may reach without preventing the neighbour's compromise or the link itself.

A compromised hosted payload used as a doorway into the host is the case the mediated access mechanism exists to close. Moderate rather than high because the technique's initial compromise may arrive through the payload's own parallel ground infrastructure, which is outside the space-segment mediation the practice describes.

Peripherals and removable media ingested over standard interfaces are an unmediated path into the vehicle. The practice bounds what such a device can reach once attached, but does not govern the ingestion itself.

The inverse case, the host vehicle reaching into the payload, is the same boundary and the same mediation. Moderate for the same reason as IA-0006.

Pivoting through the host-payload boundary to reach additional subsystems is unauthorized access to critical subsystems in the space segment, and the mediated gateway the practice requires is what stops the pivot at the boundary.

The technique is movement across a flat bus where any node that can transmit may influence many others; the practice requires a mediated access mechanism preventing unauthorized access to critical subsystems in the space segment. The mediation the practice mandates is precisely the absent partitioning the technique exploits.

Crosslink hopping crosses a vehicle-to-vehicle boundary rather than an internal subsystem boundary. Mediated access to critical subsystems limits what a compromised neighbour can reach once it is inside, so the practice governs the consequence rather than interdicting the crossing.

A docking or berthing interface is a high-trust, high-bandwidth connection into the vehicle. Mediating access to critical subsystems bounds what the visiting vehicle can reach, though the practice does not speak to the docking sequence itself.

The launch vehicle interface carries data and power into the payload during integration and ascent. Mediated subsystem access bounds the reach of anything arriving that way, without addressing the shared EGSE networks the technique also names.

A rideshare co-passenger reaching the primary payload crosses exactly the boundary the practice requires be mediated, though the practice does not govern the shared launch accommodation itself.