Confused between: viewset's create -> serializer's validate -> viewsets's perform create -> serializer's save -> serializer's create -> models'save. Where to modify/add data.

Modifying request data, like setting "creator" to the "requesting user", checking and adding fields like "creator", "workspace" to the data if not present. If instance is already present, making sure that the old data is used, so user cannot modify it.

These should be done in view's create or serializer's validate or view's perform_create or serializer's save or serializer's create or model's save methods?