# Input validation

URL: /systems/trust-and-governance/controls/input-validation · Id: `control:input-validation`

> Every Action’s inputs are checked against its Verb’s declared fields before it runs, and invalid input ends the Action refused.

Every [Action](/business/nouns/action)’s inputs are checked against its [Verb](/business/nouns/verb)’s declared fields before it runs, and invalid input ends the Action refused.

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 PI1.2](/systems/trust-and-governance/criteria/soc2/pi1-2) | The entity implements policies and procedures over system inputs so that they are complete and accurate. |

## Implemented by
- [Product definition](/workflows/processes/product-definition)
- [Verification](/code/verification)
- [Permissions](/code/platform/permissions)

## Test
| Step | Rule |
| --- | --- |
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Action in the report period. |
| Assert | Each `done` Action’s inputs match its Verb’s fields, and each mismatch ended `refused` naming the failing field. |

## Owner
[Engineering Lead](/agents/engineering/engineering-lead), [Engineering Team](/agents/engineering).

## Example
An [Agent](/business/nouns/agent) calls `Order.place` on a bookkeeping service with a month field of `13`. The Action ends `refused`, naming the `month` field, and nothing is billed.