# Input validation: valid format does not guarantee meaning

https://thiago.limaesilvatecnologia.com.br/en/artigos/input-domain/

Published: 2026-09-12

Rules must understand the operation's domain.

Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.

Reading-path month: April 2026

Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.

A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.

## The architecture decision

A value can match its expected type while violating a business rule. Validating a date does not establish whether that date is allowed for this transaction.

## Practical application

Editorial proposal: separate structural checks from domain conditions. For a hypothetical booking, consider date relationships, booking state and change authorization. Document where the decision is enforced.

## How to verify

Ask for formally correct inputs that should be rejected. Discuss ambiguity with product before implementation. Avoid duplicated, inconsistent rules; interface messages help users, but decisions must remain trustworthy when callers use the API directly.

## Sources

- [OWASP — Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html). Accessed: 2026-09-12.

[Profile: Thiago Silva | Cyber Architect](https://thiago.limaesilvatecnologia.com.br/en/perfil/)