The strongest design rule is one the agent can't argue with, and that means putting it in the types.
Parse, don't validate
Where data enters, turn it into a type that can only hold good data, rather than checking it and passing the original along. After that nothing needs to check again, and nothing can forget to.
An agent adding a new code path may not know a check is needed. If the function takes a parsed type, it can't be called with raw input, because the type checker says no. A rule held in the types holds in every session.
Say it to your agent
“Parse the request body once in the route with a zod schema, into an Order type where quantity is a positive integer. Everything after that takes Order and not unknown. Delete the isValidOrder checks further down.”