Validation & Trust
Three different validations that are routinely confused: is this well-formed, is this allowed by the business, and is this consistent with what the database already holds.
Well-formed, permitted, and consistent are three different questions with three different enforcement points — and only the last one survives a race.
The only check that needs no state: is this payload the right shape, the right types, and small enough to look at?
Rules that need loaded state and an actor — and the fact that every answer they give is already stale.
The only check evaluated inside the write — which is why it is the only one that survives two requests arriving at the same instant.
A check that returns a boolean throws away what it learned; a check that returns a typed value hands the knowledge to every line below it.
Body, query, path, headers, cookies, files, webhooks, external responses — and the second-order case where your own database hands back something a request wrote.
Three layers reject for three reasons, so one 400 with a sentence in it is the wrong answer to all three.