Well you enforce this with types. That’s how every other language does it. By specifying that the type of the function has to be a sanitised string, it will reject unsanitised string with the type checker.
> it has no way of knowing if it’s sanitised or not
It does. You define the SanitisedString class. Constructing one sanitises the string. Then when you specify that as the argument, it forces the user to sanitise the string.
If you want to do it without types, you can check with `isinstance` at runtime, but that is not as safe.