How do you actually enforce module boundaries so they don't erode over time?

Layer three mechanisms. First, the Maven module graph itself: if web only depends on application, it physically cannot import infrastructure classes without adding the dependency, which would be an obvious code-review smell.

Second, maven-enforcer with banned-dependency rules fails CI if someone declares an illegal direct dependency. Third, ArchUnit tests assert at the package level that, for instance, no domain class imports org.springframework and controllers don't touch repositories, catching violations that sneak in transitively. Relying on discipline alone fails; combining structural prevention with automated tests in the build is what keeps the architecture intact as the team grows.