The only place it make sense to me is the validation = at the route level you want to ensure that the given model exists / request attributes defining relationship (pivot), are there. This is how Laravel does this. Having said that this should be responsibity of domain rather than application