I don’t think this is quite right: “debiting someone’s account at a different bank requires validation that they have permission to do so”.

I believe the Nacha rules stipulate that the originator must have obtained authorization for the debit (and there are rules governing this in more detail), but the practices around “validating” or “verifying” that it is permitted are done for risk management purposes rather than because the rules mandate them. It is hard to point to proof of this from the horse’s mouth because the operating rules are not freely available.