Can't fully enforce that one, but I require only my specific HTTP router / SQL library to be used, and disallow the import of express / pg libraries via eslint. I also disable the use of JSON.parse via eslint. Combined with strong language in the CLAUDE.md, I haven't seen it get around my guard rails.