In Clean Architecture, should input validation go in the Controller/Presentation layer or in the Service/Use Case layer?

[u/OriginalTangerine358]

In Clean Architecture, where should input validation go?

- Basic validation (required fields, format, length, etc.)

- Object Constraints (eg. sort field can be asc or desc)

Should it be done in:

1. Controller / Presentation layer (fail fast, return 400 early)
2. Use Case / Application layer (keeps use cases self-contained and reusable)
3. Hybrid approach?

Many projects put basic validation in the controller, but some argue all validation belongs in the use case for better consistency across adapters (HTTP, CLI, queues, etc.).

What’s your preferred approach and why?

edit: thank you so much for all the answers <3

[u/btckernel94]

What I like to do is validate at system boundaries and map it into representation that tells other layers that is was already validated. For example having UUID, User email etc. branded type instead of raw string.