Python makes it easy to pass data around as dicts, nested JSON blobs, and “whatever the client sent”.
That flexibility is useful when you own the shape. It gets expensive when the data crosses a trust boundary - an HTTP body, a webhook, a file from another team - and you treat it like it already matches your assumptions.
You may already know Pydantic. This article is not a tour of fields and validators.
It is about a design rule that is easy to skip when the happy path works: validate at the boundary, then move on.
Keep flexibility only where you chose it.
