Protect Your Entities with Domain Validation

Domain validation in ASP.NET Core is often misplaced in controllers, services, or via DataAnnotations, leading to fragile systems where entities can exist in invalid states. Following Domain-Driven Design principles, validations should live inside the domain entities themselves — using private setters, read-only collections, constructor-enforced invariants, and custom DomainException classes. This approach makes entities self-protecting, prevents corrupted data from reaching the database, and keeps business rules co-located with the concepts they govern. FluentValidation still has a role for validating input data at the boundary, while controllers and services handle security, authorization, and cross-aggregate flow checks.