payloadcms · paulpopus · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026
diff --git a/docs/access-control/collections.mdx b/docs/access-control/collections.mdx
@@ -39,6 +39,7 @@ export const CollectionWithAccessControl: CollectionConfig = {
     read: () => {...},
     update: () => {...},
     delete: () => {...},
+    validate: () => {...},
 
     // Auth-enabled Collections only
     admin: () => {...},
@@ -53,12 +54,13 @@ export const CollectionWithAccessControl: CollectionConfig = {
 
 The following options are available:
 
-| Function     | Allows/Denies Access                                                 |
-| ------------ | -------------------------------------------------------------------- |
-| **`create`** | Used in the `create` operation. [More details](#create).             |
-| **`read`**   | Used in the `find` and `findByID` operations. [More details](#read). |
-| **`update`** | Used in the `update` operation. [More details](#update).             |
-| **`delete`** | Used in the `delete` operation. [More details](#delete).             |
+| Function       | Allows/Denies Access                                                                                              |
+| -------------- | ----------------------------------------------------------------------------------------------------------------- |
+| **`create`**   | Used in the `create` operation. [More details](#create).                                                          |
+| **`read`**     | Used in the `find` and `findByID` operations. [More details](#read).                                              |
+| **`update`**   | Used in the `update` operation. [More details](#update).                                                          |
+| **`delete`**   | Used in the `delete` operation. [More details](#delete).                                                          |
+| **`validate`** | Optionally overrides `update` access for [on-demand validation](../validation/overview#access-control-and-hooks). |
 
 If a Collection supports [`Authentication`](../authentication/overview), the following additional options are available:
 

diff --git a/docs/access-control/fields.mdx b/docs/access-control/fields.mdx
@@ -48,6 +48,7 @@ export const Posts: CollectionConfig = {
         create: ({ req: { user } }) => { ... },
         read: ({ req: { user } }) => { ... },
         update: ({ req: { user } }) => { ... },
+        validate: ({ req: { user } }) => { ... },
       },
       // highlight-end
     };
@@ -57,11 +58,12 @@ export const Posts: CollectionConfig = {
 
 The following options are available:
 
-| Function     | Purpose                                                                                                    |
-| ------------ | ---------------------------------------------------------------------------------------------------------- |
-| **`create`** | Allows or denies the ability to set a field's value when creating a new document. [More details](#create). |
-| **`read`**   | Allows or denies the ability to read a field's value. [More details](#read).                               |
-| **`update`** | Allows or denies the ability to update a field's value [More details](#update).                            |
+| Function       | Purpose                                                                                                                                       |
+| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| **`create`**   | Allows or denies the ability to set a field's value when creating a new document. [More details](#create).                                    |
+| **`read`**     | Allows or denies the ability to read a field's value. [More details](#read).                                                                  |
+| **`update`**   | Allows or denies the ability to update a field's value. [More details](#update).                                                              |
+| **`validate`** | Optionally overrides `update` access for candidate field data during [on-demand validation](../validation/overview#access-control-and-hooks). |
 
 ### Create
 

diff --git a/docs/access-control/globals.mdx b/docs/access-control/globals.mdx
@@ -37,6 +37,7 @@ const GlobalWithAccessControl: GlobalConfig = {
   access: {
     read: ({ req: { user } }) => {...},
     update: ({ req: { user } }) => {...},
+    validate: ({ req: { user } }) => {...},
 
     // Version-enabled Globals only
     readVersions: () => {...},
@@ -49,10 +50,11 @@ export default Header
 
 The following options are available:
 
-| Function     | Allows/Denies Access                                            |
-| ------------ | --------------------------------------------------------------- |
-| **`read`**   | Used in the `findOne` Global operation. [More details](#read).  |
-| **`update`** | Used in the `update` Global operation. [More details](#update). |
+| Function       | Allows/Denies Access                                                                                              |
+| -------------- | ----------------------------------------------------------------------------------------------------------------- |
+| **`read`**     | Used in the `findOne` Global operation. [More details](#read).                                                    |
+| **`update`**   | Used in the `update` Global operation. [More details](#update).                                                   |
+| **`validate`** | Optionally overrides `update` access for [on-demand validation](../validation/overview#access-control-and-hooks). |
 
 If a Global supports [Versions](../versions/overview), the following additional options are available:
 

diff --git a/docs/access-control/overview.mdx b/docs/access-control/overview.mdx
@@ -12,6 +12,10 @@ Access Control determines what a user can and cannot do with any given Document,
 
 Access Control functions are scoped to the _operation_, meaning you can have different rules for `create`, `read`, `update`, `delete`, etc. Access Control functions are executed _before_ any changes are made and _before_ any operations are completed. This allows you to determine if the user has the necessary permissions before fulfilling the request.
 
+[On-demand validation](../validation/overview#access-control-and-hooks) uses its own first-class
+`validate` operation for collection, global, and field access control. Its access policy falls back
+to the corresponding `update` function unless `validate` is configured explicitly.
+
 There are many use cases for Access Control, including:
 
 - Allowing anyone `read` access to all posts

diff --git a/docs/configuration/localization.mdx b/docs/configuration/localization.mdx
@@ -10,6 +10,8 @@ Localization is one of the most important features of a modern CMS. It allows yo
 
 With Localization, you can begin to serve personalized content to your users based on their specific language preferences, such as a multilingual website or multi-site application. There are no limits to the number of locales you can add to your Payload project.
 
+You can also [validate one or more locales without saving](../validation/overview).
+
 To configure Localization, use the `localization` key in your [Payload Config](./overview):
 
 ```ts
@@ -95,7 +97,7 @@ The locale codes do not need to be in any specific format. It's up to you to def
 
 | Option               | Description                                                                                                                               |
 | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| **`code`** \*        | Unique code to identify the language throughout the APIs for `locale` and `fallbackLocale`                                                |
+| **`code`** \*        | Unique code to identify the language throughout the APIs for `locale` and `fallbackLocale`.                                               |
 | **`label`**          | A string to use for the selector when choosing a language, or an object keyed on the i18n keys for different languages in use.            |
 | **`rtl`**            | A boolean that when true will make the admin UI display in Right-To-Left.                                                                 |
 | **`fallbackLocale`** | The code for this language to fallback to when properties of a document are not present. This can be a single locale or array of locales. |

diff --git a/docs/local-api/overview.mdx b/docs/local-api/overview.mdx
@@ -21,6 +21,7 @@ Here are some common examples of how you can use the Local API:
 - Seeding data via Node seed scripts that you write and maintain
 - Opening custom Next.js route handlers which feature additional functionality but still rely on Payload
 - Within [Access Control](../access-control/overview) and [Hooks](../hooks/overview)
+- [Validating document candidates without saving them](../validation/overview#local-api)
 
 ## Accessing Payload
 

diff --git a/docs/plugins/multi-tenant.mdx b/docs/plugins/multi-tenant.mdx
@@ -84,7 +84,7 @@ type MultiTenantPluginConfig<ConfigTypes = unknown> = {
        *
        * The function receives:
        *  - accessResult: the original result from the access control function
-       *  - accessKey: 'read', 'create', 'update', 'delete', 'readVersions', or 'unlock'
+       *  - accessKey: 'read', 'create', 'update', 'delete', 'readVersions', 'unlock', or 'validate'
        *  - ...restOfAccessArgs: the original arguments passed to the access control function
        */
       accessResultOverride?: CollectionAccessResultOverride
@@ -261,7 +261,7 @@ type MultiTenantPluginConfig<ConfigTypes = unknown> = {
    *
    * The function receives:
    *  - accessResult: the original result from the access control function
-   *  - accessKey: 'read', 'create', 'update', 'delete', 'readVersions', or 'unlock'
+   *  - accessKey: 'read', 'create', 'update', 'delete', 'readVersions', 'unlock', or 'validate'
    *  - ...restOfAccessArgs: the original arguments passed to the access control function
    */
   usersAccessResultOverride?: CollectionAccessResultOverride

diff --git a/docs/rest-api/overview.mdx b/docs/rest-api/overview.mdx
@@ -14,6 +14,9 @@ keywords: rest, api, documentation, Content Management System, cms, headless, ja
 The REST API is a fully functional HTTP client that allows you to interact with your Documents in a RESTful manner. It supports all CRUD operations and is equipped with automatic pagination, depth, and sorting.
 All Payload API routes are mounted and prefixed to your config's `routes.api` URL segment (default: `/api`).
 
+To check collection or global candidates without saving them, use the
+[on-demand validation endpoints](../validation/overview#rest-api).
+
 For example, if you have a Collection called `pages`, you can fetch its documents directly from the browser or any HTTP client:
 
 ```ts