Which layers should be allowed to fire AJAX requests?

Adapters are usually used to retrieve models from back end. Route usually use store to retrieve models.

If controllers are only used to decorate model for view to consume, should they be allowed to retrieve new information?

Where would something like an AJAX form validation occur, such as validating if an email or username has already been used. I would assume something like that would need to be in the controller?