4.5. Validation and Sensitive Data
💡 First Principle: Correctness and secrecy are both enforced in the configuration layer — custom conditions stop bad values before they reach a provider, and sensitive/ephemeral mechanisms control whether secret values ever get written down — so you defend quality and security where the data enters, not after.
Why care: These are 004's emphasized additions. Custom conditions (validation, pre/postconditions, check blocks) and the secret-handling story (sensitive vs. ephemeral vs. write-only) are newer, frequently tested, and easy to confuse with one another.
The mental model: Validation is a bouncer checking IDs at the door (bad values never get in); sensitive/ephemeral handling is about whether you photocopy the ID and file it (state) or just glance and forget (ephemeral).
⚠️ Common Misconception: "All these validation features do the same job." They differ by when and what they check: variable validation guards a value at input, pre/postconditions guard a resource's assumptions and guarantees, and check blocks make ongoing, non-blocking assertions about your infrastructure.
