Use at a boundary that takes untrusted input — API, config, user data, a queue message. Parse it into a typed value that makes invalid states unrepresentable, instead of validating and passing the raw data onward for the core to re-check or blindly trust.
