Writing Input Validation With LLMs in November 2026: Collect Real Bad Inputs First, Validate at the Boundary, and Test Every Rejection
Most production bugs that start with "a user sent something weird" come down to missing or sloppy input validation. A form accepted a negative quantity. An API took an email field holding 4,000 characters. A CSV import let a date like 31/02/2026 through, and three reports broke a week later. Language models are quick at writing validation code: give one a description of a field and you get a Pydantic model, a Zod schema, or a JSON Schema in seconds. The catch is that a model writes the rules it imagines your data follows, not the rules your data actually needs. This guide shows how to use an LLM to write validation that holds up, by feeding it real inputs, putting the checks in the right place, and proving each rule with tests. What Validation Is For (and What It Is Not) Validation answers one question: is this input acceptable for this operation, yes or no, and if no, why? It is worth being clear about what it does not do before you prompt anything: It is not security b...