Building Joi validation middleware is exactly the kind of structured coding work AI handles well.

Validation middleware follows a highly repeatable pattern: define schema, apply middleware, write test cases. The same structural approach applies across all 15 endpoints with minimal unique judgment per route.

The core requirements are clear (Joi, Jest, type-checking, length limits, character sets), but specifics like exact allowed character sets, field-level length limits, and which injection vectors to test require either codebase inspection or human clarification to get right.

The agent needs read access to the existing Express route files, request shape definitions, and any existing validation logic. Without the actual codebase, it can only produce generic templates that may not match real endpoint contracts.

Overly strict schemas could break legitimate requests in production, and missed injection vectors leave real security gaps. However, the work is code-reviewed before deployment and tests surface most regressions, keeping risk manageable.

Security validation rules for REST APIs are well-established and largely mechanical. Decisions about allowed character sets and length limits are technical constraints, not taste or ethics calls, making human intuition minimally necessary here.