What is your usual approach when you pass validated data into an action? Do you revalidate the data in the action or is there an implicit contract/assumption that the data is validated by the caller?