diff --git a/backend/services/ai_config.py b/backend/services/ai_config.py
index 819e97f..652e947 100644
--- a/backend/services/ai_config.py
+++ b/backend/services/ai_config.py
@@ -196,6 +196,17 @@ async def load_provider_config_by_id(session: AsyncSession, provider_id: str) ->
     )
 
 
+# ── Provider ID validator (D-11 migration) ───────────────────────────────────
+
+def validate_provider_id(v: str) -> str:
+    """Service-layer provider_id validator; raises ValueError per CLAUDE.md service-vs-API rule."""
+    if v not in PROVIDER_DEFAULTS:
+        raise ValueError(
+            f"Unknown provider_id {v!r}. Must be one of: {list(PROVIDER_DEFAULTS.keys())}"
+        )
+    return v
+
+
 # ── Startup seed ──────────────────────────────────────────────────────────────
 
 async def seed_system_settings_from_env(session: AsyncSession) -> None: