Validation Amnesia: Why AI Code Forgets Rules It Just Checked

AI-generated code checks input at the front door and then quietly forgets the rule three functions later, because each function signature is treated as a finished contract rather than a claim that still needs proof.

The Details:

• When a model writes a function expecting a User or an email string, it reasons as if validation already happened upstream. That assumption is locally correct for the function in front of it, but the actual rule might live two files away, in an old pull request, or only in a developer's memory. Nothing in the visible code forces the model to re-check.
• Serialization boundaries erase constraints silently. A validated email passed through JSON.stringify, a database round trip, or a cache read comes back out as a plain string with no memory of ever being checked. Developers treat these as internal plumbing, not untrusted input, so nobody re-validates there.
• Retry logic and merge points are two quiet failure modes. A failed request often gets replayed from a logged payload captured after validation, skipping the gate entirely on the second attempt. When two code paths merge, the instinct is to assume the stricter path's rule covers both, but the unvalidated path contaminates the result with nothing in the code flagging it.
• The durable fix is structural, not behavioral: encode constraints in types so the compiler enforces them everywhere. A ValidatedEmail type, TypeScript branded types, or Rust newtypes make it impossible to compile code that accepts a raw string where a checked value is required. Teams without that infrastructure can get partway there with schema libraries like Zod or Pydantic, property-based testing to surface unchecked edge cases, and a hard rule banning raw primitives across module boundaries.

Bottom Line: Rules enforced only by memory eventually get forgotten by someone, human or AI; rules enforced by types travel with the data and can't be dropped.