What is a common mistake with model binding and validation in Web API?

Binding directly to persistence entities can enable over-posting and mix transport concerns with domain rules.