Move validation logic into policy object