But if your server doesn't enforce data consistency -- that is, the business logic resides on the client -- you can't rely on the quality of your input. And if

But if your server doesn't enforce data consistency -- that is, the business logic resides on the client -- you can't rely on the quality of your input. And if your authorization sanitizes the data to ensure consistency, then you've just built your middle tier for logic.