diff --git a/eslint.config.mjs b/eslint.config.mjs
index 14dfa593..7d39d538 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -380,6 +380,72 @@ export default [
     },
   },
 
+  // =============================================================================
+  // BFF Architecture: Controllers must use facades, not integration internals
+  // See: docs/decisions/007-service-classification.md
+  // Note: Set to "warn" for incremental adoption. Upgrade to "error" once violations are fixed.
+  // =============================================================================
+  {
+    files: ["apps/bff/src/modules/**/*.controller.ts"],
+    rules: {
+      "no-restricted-imports": [
+        "warn",
+        {
+          paths: [
+            {
+              name: "@customer-portal/domain",
+              message:
+                "Do not import @customer-portal/domain (root). Use @customer-portal/domain/<module> instead.",
+            },
+          ],
+          patterns: [
+            {
+              group: ["@customer-portal/domain/**/src/**"],
+              message: "Import from @customer-portal/domain/<module> instead of internals.",
+            },
+            {
+              group: ["@customer-portal/domain/*/*", "!@customer-portal/domain/*/providers"],
+              message:
+                "No deep @customer-portal/domain imports. Use @customer-portal/domain/<module> (or BFF-only: .../<module>/providers).",
+            },
+            {
+              group: ["@customer-portal/domain/*/providers/*"],
+              message:
+                "Do not deep-import provider internals. Import from @customer-portal/domain/<module>/providers only.",
+            },
+            {
+              group: ["@bff/integrations/*/services/*", "@bff/integrations/*/connection/*"],
+              message:
+                "Controllers should not import integration services or connection internals directly. Import from @bff/integrations/*/facades/* instead (ADR-007).",
+            },
+          ],
+        },
+      ],
+    },
+  },
+
+  // =============================================================================
+  // BFF Architecture: Aggregators must be read-only (no mutation methods)
+  // See: docs/decisions/007-service-classification.md
+  // =============================================================================
+  {
+    files: [
+      "apps/bff/src/aggregators/**/*.ts",
+      "apps/bff/src/modules/me-status/me-status.service.ts",
+      "apps/bff/src/modules/users/infra/user-profile.service.ts",
+    ],
+    rules: {
+      "no-restricted-syntax": [
+        "warn",
+        {
+          selector: "MethodDefinition[key.name=/^(create|update|delete|save|remove|add|set)[A-Z]/]",
+          message:
+            "Aggregators must be read-only. Mutation methods should be moved to orchestrators or services (ADR-007).",
+        },
+      ],
+    },
+  },
+
   // =============================================================================
   // Node globals for tooling/config files
   // =============================================================================