Select the correct validation layer in an API-led architecture (RAML/OAS request schema enforcement via APIkit/automatic 400 responses, gateway policy validation, vs in-flow business validation) for a given separation-of-concerns and error-response requirement.