UML 2.5.1 Visibility: Protected Modifier Mapping Across Architectural Layers

In UML 2.5.1, visibility modifiers such as Public (+), Private (-), and Package (~) are used to define encapsulation boundaries for attributes and operations within a classifier. While these notations map clearly to most object-oriented languages within a single module, ambiguity arises when modeling transitions between distinct architectural layers.

The goal is to maintain strict encapsulation when bridging a domain model to a Data Transfer Object (DTO) layer. There is uncertainty regarding how the Protected (#) modifier should be interpreted when a subclass exists in a different architectural layer or package than its parent, specifically concerning whether the visibility remains restricted to the inheritance hierarchy or expands based on the layer's boundary.

• Does the UML 2.5.1 specification provide a formal mechanism to restrict Protected visibility across separate architectural layers?
• How should the Protected marker be represented to prevent accidental public exposure when the target implementation language handles cross-package inheritance differently?