A team integrates a vendor CRM whose customer model contradicts theirs. Six months later vendor field names and status codes appear throughout the codebase. What was missing and what is the fix now?

What is being tested

Whether you can name the pattern, and whether you understand the difference between routing (gateway) and translating meaning (ACL).

Why the leak happened

Without a deliberate boundary, passing the foreign object through is always easier than translating it. One method takes the vendor's ContactDTO because that is what it received. A second reuses it because it is already there. Within months the vendor's notion of a customer — its identifiers, its eleven-value status enum of which three are used, its dates that are sometimes strings and sometimes zero — has become your domain model by default.

The consequence is that you can no longer replace the vendor. What was a commercial decision has become an eighteen-month engineering project, which is exactly the leverage you did not want to give away.

Why a gateway does not solve it

A gateway routes, authenticates and rate limits. It operates on transport and protocol. An ACL operates on meaning: it maps foreign concepts into domain concepts, which sometimes have no clean correspondence and require a real design decision. A pass-through gateway with renamed fields is not an ACL — it has moved the leak, not stopped it.

The fix now

1. Define the domain model you actually want, independent of the vendor. This is the step teams skip, and skipping it produces an ACL that maps one-to-one onto the vendor's model — which means the corruption already happened and you have added a layer for nothing.
2. Create the translation module with a clear boundary and the vendor SDK as a private dependency.
3. Migrate call sites incrementally, one at a time, behind tests. Not a big-bang refactor.
4. Add a fitness function — a build-time check that the vendor's package is not imported outside the ACL. Without enforcement it will leak again, because the same pressure that caused it the first time has not gone away.
5. Translate errors as well as data. Foreign error codes must become domain failure concepts, or the leak simply relocates to the exception handlers.

Details that matter in practice

• Log both sides during rollout. Mapping mismatches surface as business anomalies rather than errors, so they are found by accounting rather than by monitoring unless you look for them.
• Watch the mapping's performance. A translation that does an N+1 lookup against the vendor per record is a common and expensive mistake.
• Resist logic accumulating in the layer. It starts translating, then starts deciding, and becomes a third system nobody owns.

The value being bought

Optionality — and unlike most abstractions, this option is very likely to be exercised, because vendor systems and legacy cores are eventually replaced. That is what makes the ACL one of the few speculative boundaries that reliably pays for itself.