One thing people don’t consider, is that validation should be done on all tiers. JS to do the forms and validate at the client, request calls and then database calls would be handled on the server. ColdBox when using ORM uses the last two tiers as part of that validation process.
The validation in ColdBox is for ORM Entities and I think other Bean like objects, not 100% sure on that last part but I am almost certain it is tied into the ORM side of things.