How should model binding and validation be designed for production in Web API?

Use request DTOs, explicit validation, and separate transport validation from business validation. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.