Personally I prefer to keep most nontrivial validation at the app level. Application code is typically easier to change (redeploying is often easier than a database migration), and it also makes error handling easier.