I think generally we parse and create a criteria from client input in the controller layer and rest in the manager layer. Not a blocker, just something that we generally follow.