What it does: Every message carries two replay-prevention mechanisms:

• Nonce (number used once): A unique random identifier generated per message. The receiving agent maintains a nonce cache and rejects any message whose nonce has been seen before. This prevents exact replay of any past message.
• Timestamp with validity window: The message includes a generation timestamp. The receiving agent rejects messages outside a narrow validity window (typically 30 seconds to 5 minutes). This limits the attack window even if the nonce cache is cleared.

Why both mechanisms are needed: Nonces alone require indefinitely growing caches. Timestamps alone are exploitable if the attacker replays within the validity window. Together they provide strong replay protection with bounded cache size: the nonce cache only needs to cover the validity window, not all-time history.

Threat closed: Type 4 (replay attacks). The month-old access-grant message in Scenario 3 would have a nonce already seen and a timestamp outside the validity window — both checks reject it.

What it does: The communication topology is enforced at the infrastructure level. Each agent is only authorized to send specific message types to specific recipient agents, and to receive messages only from specific authorized senders. Unauthorized sender/recipient combinations are rejected at the infrastructure layer — before the receiving agent ever sees the message.

Implementation patterns:

• Queue-level access policies: AWS SQS resource policies, Kafka ACLs, or RabbitMQ permissions that restrict which identities can publish to which queues. Only the classification agent's identity can publish to the moderation queue.
• API gateway routing rules: The gateway enforces that POST /deployment-agent/deploy can only be called by the orchestrator service identity — not by any authenticated agent.
• Network policies: Kubernetes NetworkPolicy or AWS security groups that restrict which services can initiate connections to which other services.

Threat closed: Type 6 (queue injection), and significantly raises the bar for Types 1 and 3 by requiring the attacker to compromise a specifically authorized sender identity.