Use it when
Domains or layers need explicit, compiler-checked dependencies and public module exports. Useful for agent-maintained applications as well as human-maintained code.
How it fits
Declare each boundary in its root module with use Boundary, explicit deps and a small exports list. Add the compile-time dependency and compiler below. A boundary always exports its root module; prefer explicit exports over exports: :all. Keep allowed calls aligned with the architecture.
What else to account for
Violations are compiler warnings unless compilation uses --warnings-as-errors. External OTP application calls are allowed by default; opt into selected app checks or strict mode when required. Dynamic calls such as apply/3 are not checked. Boundary enforces static module references; it does not isolate an agent’s files, processes or network access. Libraries can limit the compiler to dev/test as the compiler documentation describes.
Set it up
# In mix.exs deps/0:
{:boundary, "~> 0.11", runtime: false}
# In mix.exs project/0:
compilers: [:boundary] ++ Mix.compilers()
# In each domain root module (adapt the names):
use Boundary, deps: [MyApp.Accounts], exports: []
Run mix deps.get, then mix compile --warnings-as-errors in the environments your CI checks. Add a temporary forbidden static call to confirm the check fails, remove it, and rerun successfully. The dependency alone does not enforce boundaries.
Social login and OIDCAssent
Use it when
Users need to sign in with Google, GitHub, Apple or an OpenID Connect provider.
How it fits
Integrate provider authentication with the application's existing accounts and sessions.
What else to account for
Account linking, session management and permissions remain application concerns. SAML is a separate requirement.