Validation: validators, clean() and model rules

A clubhouse booking of Nivas has four rules: a real flat, an end after the start, at most 4 hours, and at most 10 guests. The recorded run below sends two bad bookings down five ways of writing one: the booking that ends before it starts was refused on every path it took, because the database checks that rule too, while the one of 6 hours was saved twice.

Every rule can be written in several places: a validator, a form method, the model, the database. This lesson writes the validators of Nivas, follows the fixed order in which Django runs every check of a form, shows which checks each way of saving a model runs and which it skips, and ends with a table that decides where a rule belongs, and with error messages that tell a resident how to fix the value.

A validator is a function that raises ValidationError with a code

A validatorvalidator: A callable that receives one value and raises ValidationError when the value breaks a rule, such as validate_flat_code. Because it sees only the value, the same validator can guard model fields and form fields. takes one value and raises ValidationErrorValidationError: The exception Django's validation raises and collects. It carries a message for people, a code for programs that does not change with translation, and params that fill the placeholders of the message. when the value breaks a rule; it returns nothing when the value is fine. Nivas has two. validate_flat_code is a plain function: a block letter from A to F, a hyphen and a three- or four-digit number. validate_ifsc is an instance of Django’s RegexValidator class, made with the pattern of a bank branch code:

import re

from django.core.exceptions import ValidationError
from django.core.validators import RegexValidator

FLAT_CODE = re.compile(r'[A-F]-[0-9]{3,4}')


def validate_flat_code(value):
    """A flat code is a block letter from A to F, a hyphen and a flat number of three or four digits."""
    if not FLAT_CODE.fullmatch(value):
        raise ValidationError(
            '"%(value)s" is not a flat code. Write the block, a hyphen and the number, such as B-1203.',
            code='flat_code',
            params={'value': value},
        )


# An IFSC: four letters for the bank, a zero, then six letters or digits for the branch.
validate_ifsc = RegexValidator(
    r'\A[A-Z]{4}0[A-Z0-9]{6}\Z',
    message='Enter the 11 characters of the IFSC, such as ABCD0123456.',
    code='ifsc',
)

from datetime import timedelta

from django.core.exceptions import ValidationError
from django.core.validators import MaxValueValidator, MinValueValidator
from django.db import models

from .validators import validate_flat_code, validate_ifsc

LONGEST_BOOKING = timedelta(hours=4)


class Flat(models.Model):
    code = models.CharField(max_length=6, unique=True, validators=[validate_flat_code])

    def __str__(self):
        return self.code


class Booking(models.Model):
    """A booking of the clubhouse."""

    flat = models.ForeignKey(Flat, on_delete=models.CASCADE)
    starts_at = models.DateTimeField()
    ends_at = models.DateTimeField()
    guests = models.PositiveSmallIntegerField(validators=[MinValueValidator(1), MaxValueValidator(10)])
    refund_ifsc = models.CharField(max_length=11, blank=True, validators=[validate_ifsc])

    class Meta:
        constraints = [
            models.CheckConstraint(
                condition=models.Q(ends_at__gt=models.F('starts_at')),
                name='booking_ends_after_start',
                violation_error_code='ends_before_start',
                violation_error_message='A booking must end after it starts.',
            ),
        ]

    def clean(self):
        # A rule of the society, not a fact of the data: only full_clean() runs it.
        if self.starts_at and self.ends_at and self.ends_at - self.starts_at > LONGEST_BOOKING:
            raise ValidationError(
                {'ends_at': ValidationError('A booking can last at most %(hours)s hours.', code='too_long', params={'hours': 4})}
            )

This program calls both validators on good and bad values, then shows the IFSC pattern without its anchors, then gives one validator to a model field and to a form field:

"""Call the two validators of Nivas on good and bad values, then the IFSC pattern without its anchors, then one
validator in two places: on a model field and on a form field.

Run it next to manage.py. It makes a test database in memory, as manage.py test does."""

import os

os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'config.settings')

import django  # noqa: E402

django.setup()

from django import forms  # noqa: E402
from django.core.exceptions import ValidationError  # noqa: E402
from django.core.validators import RegexValidator  # noqa: E402
from django.test.utils import setup_databases, setup_test_environment  # noqa: E402

setup_test_environment()
setup_databases(verbosity=0, interactive=False, aliases={'default'})

from amenities.models import Flat  # noqa: E402
from amenities.validators import validate_flat_code, validate_ifsc  # noqa: E402


def outcome(validator, value):
    try:
        validator(value)
    except ValidationError as error:
        return f'{error.code}: {error.messages[0]}'
    return 'passes'


for name, validator, values in [('validate_flat_code', validate_flat_code, ['B-1203', 'G-1203', 'b-1203', 'B-12']),
                                ('validate_ifsc', validate_ifsc, ['ABCD0123456', 'ABCD1123456', 'ABCD012345'])]:
    print(name)
    for value in values:
        print(f'  {value!r:15} {outcome(validator, value)}')

try:
    validate_flat_code('G-1203')
except ValidationError as error:
    print(f'  the error of G-1203: code={error.code!r}, params={error.params!r}')

bare = RegexValidator(r'\A[A-Z]{4}0[A-Z0-9]{6}\Z')
print("The same pattern with Django's default message and code")
print(f"  {'ABCD1123456'!r:15} {outcome(bare, 'ABCD1123456')}")

loose = RegexValidator(r'[A-Z]{4}0[A-Z0-9]{6}', message='Enter the 11 characters of the IFSC.', code='ifsc')
print('The IFSC pattern without \\A and \\Z')
for value in ['ABCD0123456', 'refund to ABCD0123456 please', 'ABCD012345678']:
    print(f'  {value!r:30} {outcome(loose, value)}')

print('validate_flat_code on the model field and on a form field')
try:
    Flat(code='G-12').full_clean()
except ValidationError as error:
    print('  Flat(code="G-12").full_clean():', error.message_dict)


class FlatForm(forms.Form):
    code = forms.CharField(validators=[validate_flat_code])


form = FlatForm({'code': 'G-12'})
print('  FlatForm({"code": "G-12"}).errors:', dict(form.errors))

validate_flat_code
  'B-1203'        passes
  'G-1203'        flat_code: "G-1203" is not a flat code. Write the block, a hyphen and the number, such as B-1203.
  'b-1203'        flat_code: "b-1203" is not a flat code. Write the block, a hyphen and the number, such as B-1203.
  'B-12'          flat_code: "B-12" is not a flat code. Write the block, a hyphen and the number, such as B-1203.
validate_ifsc
  'ABCD0123456'   passes
  'ABCD1123456'   ifsc: Enter the 11 characters of the IFSC, such as ABCD0123456.
  'ABCD012345'    ifsc: Enter the 11 characters of the IFSC, such as ABCD0123456.
  the error of G-1203: code='flat_code', params={'value': 'G-1203'}
The same pattern with Django's default message and code
  'ABCD1123456'   invalid: Enter a valid value.
The IFSC pattern without \A and \Z
  'ABCD0123456'                  passes
  'refund to ABCD0123456 please' passes
  'ABCD012345678'                passes
validate_flat_code on the model field and on a form field
  Flat(code="G-12").full_clean(): {'code': ['"G-12" is not a flat code. Write the block, a hyphen and the number, such as B-1203.']}
  FlatForm({"code": "G-12"}).errors: {'code': ['"G-12" is not a flat code. Write the block, a hyphen and the number, such as B-1203.']}

Three things from the run. First, an error carries more than its message: code='flat_code', which a test or an API can compare however the site is translated, and params={'value': 'G-1203'}, which fills %(value)s in the message; Django’s documentation asks for both, and for placeholders instead of text pasted into the message. Second, RegexValidator looks for its pattern with re.search(), anywhere in the value. Without \A and \Z the pattern accepted 'refund to ABCD0123456 please' and a 13-character code; with them, the whole value must match. Third, the same function guarded Flat.code and a form field, and both reported the same message, because a validator receives the value only, never the form or the model.

b-1203 failed too: the validator wants capitals. Whether a resident may type small letters is a question of the step in which the value is converted, which the next section answers.

Django runs the checks of a form in a fixed order

Each field of a bound form is cleaned in three steps of its own, then the form’s method for that field, and the form’s clean() runs last. This program records the steps of the flat field and the form’s two methods for five bookings; BookingForm capitalises the flat code in its field’s to_python() and turns it into a Flat row in clean_flat():

from django import forms
from django.core.exceptions import ValidationError

from .models import LONGEST_BOOKING, Flat
from .validators import validate_flat_code


class FlatCodeField(forms.CharField):
    """A CharField that writes the flat code in capitals while converting it, before any validator runs."""

    def to_python(self, value):
        return super().to_python(value).upper()


class BookingForm(forms.Form):
    flat = FlatCodeField(max_length=6, validators=[validate_flat_code])
    starts_at = forms.DateTimeField()
    ends_at = forms.DateTimeField()
    guests = forms.IntegerField(min_value=1, max_value=10)

    def clean_flat(self):
        # Runs only when the field itself passed. Its return value replaces cleaned_data['flat']: here the Flat row.
        code = self.cleaned_data['flat']
        try:
            return Flat.objects.get(code=code)
        except Flat.DoesNotExist:
            raise ValidationError('There is no flat %(code)s in Nivas.', code='unknown_flat', params={'code': code})

    def clean(self):
        # Runs after every field, whether they passed or not, so it reads with get().
        cleaned = super().clean()
        starts, ends = cleaned.get('starts_at'), cleaned.get('ends_at')
        if starts and ends:
            if ends <= starts:
                self.add_error('ends_at', ValidationError('Choose an end time after the start time.', code='ends_before_start'))
            elif ends - starts > LONGEST_BOOKING:
                self.add_error('ends_at', ValidationError('Book at most %(hours)s hours at a time.', code='too_long', params={'hours': 4}))
        return cleaned

"""Record the order in which Django cleans BookingForm: the flat field's to_python(), validate() and
run_validators(), then clean_flat(), the other fields, and the form's clean(). Then a form that capitalises the flat
in clean_flat(), one step too late.

Run it next to manage.py. It makes a test database in memory, as manage.py test does."""

import os

os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'config.settings')

import django  # noqa: E402

django.setup()

from django.test.utils import setup_databases, setup_test_environment  # noqa: E402

setup_test_environment()
setup_databases(verbosity=0, interactive=False, aliases={'default'})

from django import forms  # noqa: E402

from amenities.forms import BookingForm, FlatCodeField  # noqa: E402
from amenities.models import Flat  # noqa: E402
from amenities.validators import validate_flat_code  # noqa: E402

for code in ['A-101', 'B-1203', 'C-901']:
    Flat.objects.create(code=code)

steps = []


class TracedFlatField(FlatCodeField):
    def to_python(self, value):
        steps.append('flat.to_python')
        return super().to_python(value)

    def validate(self, value):
        steps.append('flat.validate')
        super().validate(value)

    def run_validators(self, value):
        steps.append('flat.run_validators')
        super().run_validators(value)


class TracedBookingForm(BookingForm):
    flat = TracedFlatField(max_length=6, validators=[validate_flat_code])

    def clean_flat(self):
        steps.append('clean_flat')
        return super().clean_flat()

    def clean(self):
        steps.append('clean')
        return super().clean()


def book(title, **data):
    steps.clear()
    form = TracedBookingForm({'starts_at': '2026-11-14 18:00', 'ends_at': '2026-11-14 21:00', 'guests': '6', **data})
    valid = form.is_valid()
    print(title)
    print('  steps:', ' > '.join(steps))
    print('  is_valid():', valid, '| cleaned flat:', repr(form.cleaned_data.get('flat')))
    for name, errors in form.errors.as_data().items():
        print(f'  errors[{name!r}]: {errors[0].code}: {form.errors[name][0]}')


book('1. flat=b-1203, 18:00 to 21:00', flat='b-1203')
book('2. flat=G-1203, a block Nivas does not have', flat='G-1203')
book('3. flat=D-404, a flat code no flat has', flat='D-404')
book('4. flat=C-901, ends at 17:00, before it starts', flat='C-901', ends_at='2026-11-14 17:00')


class LateCapitalsForm(forms.Form):
    flat = forms.CharField(max_length=6, validators=[validate_flat_code])

    def clean_flat(self):
        return self.cleaned_data['flat'].upper()  # too late: the validator has already refused b-1203


form = LateCapitalsForm({'flat': 'b-1203'})
print('5. flat=b-1203, capitalised in clean_flat() instead of to_python()')
print('  is_valid():', form.is_valid(), '| errors:', form.errors.as_data()['flat'][0].code)

1. flat=b-1203, 18:00 to 21:00
  steps: flat.to_python > flat.validate > flat.run_validators > clean_flat > clean
  is_valid(): True | cleaned flat: <Flat: B-1203>
2. flat=G-1203, a block Nivas does not have
  steps: flat.to_python > flat.validate > flat.run_validators > clean
  is_valid(): False | cleaned flat: None
  errors['flat']: flat_code: "G-1203" is not a flat code. Write the block, a hyphen and the number, such as B-1203.
3. flat=D-404, a flat code no flat has
  steps: flat.to_python > flat.validate > flat.run_validators > clean_flat > clean
  is_valid(): False | cleaned flat: None
  errors['flat']: unknown_flat: There is no flat D-404 in Nivas.
4. flat=C-901, ends at 17:00, before it starts
  steps: flat.to_python > flat.validate > flat.run_validators > clean_flat > clean
  is_valid(): False | cleaned flat: <Flat: C-901>
  errors['ends_at']: ends_before_start: Choose an end time after the start time.
5. flat=b-1203, capitalised in clean_flat() instead of to_python()
  is_valid(): False | errors: flat_code

Step through the same five bookings and watch where each one stops:

Two rules of the order matter in practice. A field that fails never reaches its clean_<field>(), so booking 2 has no clean_flat step, while the form’s clean() runs for every booking and must read cleaned_data with get(). And a step can only help the steps after it: booking 5 capitalised the code in clean_flat(), after the validator had already refused b-1203. Convert in to_python(), check in validators, look things up in clean_<field>(), compare fields in clean().

A model is validated only when code asks, never by save()

A model has its own validation, and the constraints lesson showed one part of it: full_clean()full_clean(): The model method that validates an object in four steps: its field validators, Model.clean(), the uniqueness checks and Meta.constraints. ModelForms call it; save(), update() and bulk_create() never do. reports a broken constraint before the database sees the row. It runs four steps in order: the field validators (clean_fields()), Model.clean() for rules of the whole object, validate_unique() and validate_constraints(). Booking.clean() holds a rule that is in no constraint, at most 4 hours. This program sends a booking that ends before it starts, then one of 6 hours, down every way of writing one:

"""Send two bad bookings down every path that writes a booking: the form, Model.full_clean(), save(), update() and
bulk_create(). One breaks a rule the database enforces, the other a rule only Model.clean() knows.

Run it next to manage.py. It makes a test database in memory, as manage.py test does."""

import os
from datetime import datetime, timedelta, timezone

os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'config.settings')

import django  # noqa: E402

django.setup()

from django.test.utils import setup_databases, setup_test_environment  # noqa: E402

setup_test_environment()
setup_databases(verbosity=0, interactive=False, aliases={'default'})

from django.core.exceptions import ValidationError  # noqa: E402
from django.db import IntegrityError, transaction  # noqa: E402

from amenities.forms import BookingForm  # noqa: E402
from amenities.models import Booking, Flat  # noqa: E402

flat = Flat.objects.create(code='B-1203')
six_pm = datetime(2026, 11, 14, 18, 0, tzinfo=timezone.utc)


def attempt(label, write):
    try:
        with transaction.atomic():
            result = write()
    except ValidationError as error:
        print(f'  {label}: ValidationError {error.message_dict}')
    except IntegrityError as error:
        print(f'  {label}: IntegrityError: {error}')
    else:
        print(f'  {label}: {result}')


print('A booking that ends at 17:00, before it starts at 18:00')
form = BookingForm({'flat': 'B-1203', 'starts_at': '2026-11-14 18:00', 'ends_at': '2026-11-14 17:00', 'guests': '6'})
form.is_valid()
print(f"  BookingForm: is_valid() False, errors['ends_at']: {form.errors['ends_at'][0]}")
early = dict(flat=flat, starts_at=six_pm, ends_at=six_pm - timedelta(hours=1), guests=6)
attempt('full_clean()', lambda: Booking(**early).full_clean())
attempt('save()', lambda: Booking(**early).save())
good = Booking.objects.create(flat=flat, starts_at=six_pm, ends_at=six_pm + timedelta(hours=2), guests=6)
attempt('update()', lambda: Booking.objects.filter(pk=good.pk).update(ends_at=six_pm - timedelta(hours=1)))

print('A booking of 6 hours, against the society rule of at most 4')
form = BookingForm({'flat': 'B-1203', 'starts_at': '2026-11-14 18:00', 'ends_at': '2026-11-15 00:00', 'guests': '6'})
form.is_valid()
print(f"  BookingForm: is_valid() False, errors['ends_at']: {form.errors['ends_at'][0]}")
long = dict(flat=flat, starts_at=six_pm, ends_at=six_pm + timedelta(hours=6), guests=6)
attempt('full_clean()', lambda: Booking(**long).full_clean())
attempt('save()', lambda: f'saved as booking {Booking.objects.create(**long).pk}')
attempt('bulk_create()', lambda: f'saved {len(Booking.objects.bulk_create([Booking(**long)]))} booking')
print('  bookings longer than 4 hours in the table:',
      sum(b.ends_at - b.starts_at > timedelta(hours=4) for b in Booking.objects.all()))

A booking that ends at 17:00, before it starts at 18:00
  BookingForm: is_valid() False, errors['ends_at']: Choose an end time after the start time.
  full_clean(): ValidationError {'__all__': ['A booking must end after it starts.']}
  save(): IntegrityError: CHECK constraint failed: booking_ends_after_start
  update(): IntegrityError: CHECK constraint failed: booking_ends_after_start
A booking of 6 hours, against the society rule of at most 4
  BookingForm: is_valid() False, errors['ends_at']: Book at most 4 hours at a time.
  full_clean(): ValidationError {'ends_at': ['A booking can last at most 4 hours.']}
  save(): saved as booking 2
  bulk_create(): saved 1 booking
  bookings longer than 4 hours in the table: 2

Django’s documentation says it plainly: full_clean() is not called when you call save(), and validators do not run when a model is saved. A ModelForm, the subject of the next lesson, calls full_clean() for the fields it includes, and so does the admin, which builds its forms the same way. update() becomes one SQL statement and bulk_create() inserts the objects it is given in as few queries as it can; neither calls save(), let alone full_clean(). Only the CheckConstraint held on every path the first booking took, because the database checks every row that reaches it; the 4-hour rule held only in the form and where full_clean() ran, and the run ended with 2 bookings longer than 4 hours in the table.

Each rule belongs where every write meets it

The run of the previous section gives the method: put a rule where every path that writes the data meets it, and in the form as well when a resident should see a friendly message at the field. Three questions about a rule decide most cases: can rows arrive without this form, does the rule compare a row with other rows, and does it depend on who is asking? Answer them for a rule of your own, or for “at most 4 hours”, “one booking per flat each evening” and “more than 10 guests only for the committee”:

In short, a form’s validators and its clean() give the best message, at the field, and clean() can see what the view passes in, such as the user, but they guard only the writes that go through that form. A model validator or Model.clean() guards every ModelForm and the admin. A database constraint guards every write, including update(), bulk_create() and two requests in the same second, but only reports the whole row. Rules that must always hold, such as “ends after it starts”, go in the database and are mirrored in the form for the message; rules about who is asking live where the request is, the form or the view.

A good error message says how to fix the value

A resident who meets an error has one question: what do I type instead? Compare the messages of the first run. “Enter a valid value.”, RegexValidator’s default, answers nothing; "G-1203" is not a flat code. Write the block, a hyphen and the number, such as B-1203. names the value, the rule and an example. Three habits make every message like the second:

The last row is about safety, not style. OWASP’s Error Handling Cheat Sheet warns that details such as a table, a constraint or a stack trace tell an attacker how the site is built, so a view that catches IntegrityError shows the form’s own message and logs the rest. OWASP’s Input Validation Cheat Sheet adds the matching rule for the checks themselves: describe what is allowed, an allowlist such as “letters A to F”, rather than trying to list what is not, and keep rules narrow only where the data is narrow. A flat code has one shape; a resident’s name does not, so a name field checks its length and leaves the letters alone.

Practise: an IFSC validator that explains itself

The refund form of Nivas checks the IFSC with one pattern and one message. Write validate_ifsc(value), which raises one ValidationError with its own code and a message with an example for each of four mistakes, and clean_ifsc(value), the conversion step that removes spaces and writes capitals before the validator runs. The starter file holds a small ValidationError like Django’s, so the eight sample tests run in your browser:

class ValidationError(Exception):
    """A stand-in for django.core.exceptions.ValidationError: a message, a code and params."""

    def __init__(self, message, code=None, params=None):
        super().__init__(message % params if params else message)
        self.message = message
        self.code = code
        self.params = params


def validate_ifsc(value):
    """Raise ValidationError, with a code and a message that says how to fix it, unless value is a valid IFSC."""
    if len(value) != 11:
        raise ValidationError('Enter a valid IFSC.', code='invalid')


def clean_ifsc(value):
    """Remove the spaces, write the letters in capitals, validate and return the IFSC."""
    return value

from ifsc import ValidationError, clean_ifsc, validate_ifsc


def error_of(check, value):
    """The ValidationError that check(value) raises (the test fails if it raises none)."""
    try:
        check(value)
    except ValidationError as error:
        return error
    raise AssertionError(f'{check.__name__}({value!r}) raised no ValidationError')


def test_valid_codes_pass():
    for value in ['ABCD0123456', 'ABCD0ABCDEF', 'WXYZ0A1B2C3']:
        assert validate_ifsc(value) is None, value


def test_the_length_comes_first_with_its_params():
    for value in ['ABCD012345', 'ABCD01234567', '', 'abcd']:
        error = error_of(validate_ifsc, value)
        assert error.code == 'ifsc_length', value
        assert error.params == {'length': len(value)}, value


def test_the_bank_part_is_four_capital_letters():
    for value in ['abcd0123456', 'AB1D0123456', 'ABC 0123456', 'ÄBCD0123456']:
        assert error_of(validate_ifsc, value).code == 'ifsc_bank', value


def test_the_fifth_character_is_a_zero():
    for value in ['ABCD1123456', 'ABCDO123456', 'ABCD 123456']:
        assert error_of(validate_ifsc, value).code == 'ifsc_zero', value


def test_the_branch_is_six_capital_letters_or_digits():
    for value in ['ABCD0abc123', 'ABCD012345-', 'ABCD01234 6']:
        assert error_of(validate_ifsc, value).code == 'ifsc_branch', value


def test_one_error_for_the_first_problem():
    assert error_of(validate_ifsc, 'abcd1123456').code == 'ifsc_bank'
    assert error_of(validate_ifsc, 'ABCD1abc123').code == 'ifsc_zero'


def test_every_message_shows_a_valid_example():
    for value in ['ABCD012345', 'abcd0123456', 'ABCD1123456', 'ABCD0abc123']:
        assert 'ABCD0123456' in str(error_of(validate_ifsc, value)), value


def test_clean_ifsc_removes_spaces_and_writes_capitals():
    assert clean_ifsc(' abcd 0123456 ') == 'ABCD0123456'
    assert clean_ifsc('wxyz0a1b2c3') == 'WXYZ0A1B2C3'
    assert error_of(clean_ifsc, 'abcd 1123456').code == 'ifsc_zero'

Then check the five ideas of this lesson, from validators to messages, one question at a time, the weakest idea first:

Interview questions

Warm-up (fresher): When do you write a validator, and when a clean_<field>() method?

A validator is a function or class that receives one value and nothing else, so it suits rules about the value itself: its shape, its range, its characters. Because it knows no form, the same validator can guard a model field, a form field and a serializer, and it runs wherever the field is validated. A clean_<field>() method belongs to one form: it runs after the field’s own checks and validators passed, it can read self.cleaned_data and anything the view gave the form, such as the user, and its return value replaces the field’s cleaned value. Use it for rules that need data or context, such as looking up a flat by its code, and for turning the value into something else, such as the Flat row.

Two design questions of this module’s bank start from these bookings: where each booking rule belongs, and an import that filled the table with bookings the model refuses.

Key takeaways

• A validator receives one value and raises ValidationError with a message, a code and params; it can guard model fields and form fields alike, and a RegexValidator pattern needs \A and \Z because it is searched for.
• Each field runs to_python(), validate(), its validators and then the form’s clean_<field>(); a failed field skips its clean_<field>(), and the form’s clean() runs last, always.
• full_clean() runs the field validators, Model.clean(), the uniqueness checks and the constraints; save(), update() and bulk_create() run none of them, and only the database guards those paths.
• A rule belongs where every write meets it, usually the model and the database, with a copy in the form only for a message at the field; rules about who is asking live in the form or the view.
• A good message says what to type, names the rule and reveals no table, constraint or stack trace.