The plain-English version
Checking incoming data against rules.
Why it matters
Check inputs where a trusted operation accepts them. In a connected app, enforce server-side rules even when the interface also validates input; a local-only app still needs appropriate input checks.
Let’s make it click
Reject an empty title and an invalid due date before writing the task.
Vibe Bro’s heads-up
A valid record ID may still point to a record the caller is not allowed to access.
The docs behind it
Documentation links checked .
Editorial review · October 28, 2026
Corrected: Keeps the server-side security rule while avoiding the implication that every local program requires a server.