How should input validation be designed for production?

For production, validate at trust boundaries, use allowlists for constrained values, reject oversized input, separate syntactic from business validation, return safe errors, and avoid using validation as the only defense against injection. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.