I'm thinking about defensive programming here, through model driven design. I would insert null guards where a property must not be null, but would use a Maybe struct in the cases where it's admissible.
However, I'm not sure how to explicitly model in OCL when a property can or can not be null.