This is accomplished at Google using the build system. Your visibility declaration tells the build system what's allowed to depend on a piece of code.

When deprecating old code, you can shut that door with a whitelist and gradually force consumers to migrate.

I really like how code is managed at Google.