> What layer in the code stack should make the decisions about what characters to allow?

OK, but where does it get decided what even counts a character? Should that be in the same layer? Even within a single system, there may be different sensible answers to that.