Maven Enforcer Plugin dependencyConvergence exemption ownership and build failure policy

Maven has no native alert or notification subsystem, so build-time noise control is typically delegated to documented plugin rules such as the Enforcer Plugin dependencyConvergence check. The rule is usually declared in a parent POM and inherited across a multi-module reactor.

The configuration is version-sensitive and the rule can be applied to the whole reactor, which creates a design tension between signal and noise. There is no built-in constraint for limiting transitive depth or for defining who may approve an exemption, and the plugin configuration is inherited by child modules.

An unresolved decision is the permission boundary around exemptions and failure behavior. Without an ownership model for the exclusion list, convergence violations can become noisy or block unrelated teams, and strict enforcement can be inherited unintentionally.

What ownership or approval boundary should govern additions to the exclusion list? Should a convergence violation fail the build by default or be reported without failure? How should exceptions be scoped to avoid unintended inheritance in child modules?