How should a team decide whether a given validation check belongs in a MessageDispatchInterceptor or inside an aggregate's command handler?

The deciding factor is whether the check needs the aggregate's own current state to evaluate correctly. A check that's universal and stateless — every command must have a non-blank identifier field, no command payload may exceed some maximum size — applies identically regardless of which aggregate the command is ultimately headed to, and belongs in a MessageDispatchInterceptor, since it runs centrally once for every command before any aggregate is even loaded. A check that depends on an aggregate's own data — you can't withdraw more than the current balance, you can't approve a loan above a customer's pre-approved limit — can only be evaluated after that aggregate's state has been rebuilt from its event history, which only happens inside the aggregate's own command handler. Putting a stateless, universal check inside every aggregate is repetitive and easy to forget on new command types; trying to put a stateful check inside an interceptor either doesn't work at all or forces an awkward, redundant lookup outside the aggregate.