Perl OO is weird, really. Basically $self could be anything at this point -- so long as it managed to call the method. (e.g., it could have been called as either DW::External::Account->set_username(...), or as $object->set_username().

I am not quite sure what / how to validate further here though. That is, we generally accept that $self is what we expect. Unless @xb95 means the data within $self that came from user input, e.g., the actual username being set?

I'm not sure!