The differences in the authentication requirements for incoming vs. outgoing messages (message direction) or a web service are covered by specifying their properties within separate XML sections, labeled <InboundSecurity> and <OutboundSecurity>, respectively.