$_POST = {
    user = {
        username: zeelot3k
        password: awesomesauce
        // Alias that is in the user model that points to user_profile model
        profile = {
            name: Lorenzo Pisani
            address: 550 awesome street
            aim: zeelot3k
        }
    }
    // By convention I store form fields that are not business logic in a _external array
    _external = {
        confirm-password: notawesome
    }
}

$user = ORM::factory('user');

// confirm-password validation belongs in the controller (it is not business logic, so we need to copy the password value to this _external array)
$external_validation = Validate::factory($_POST['_external'] + array('password' => $_POST['user']['password']))
    // This can only be done in the controller because the password in the model is ALWAYS hashed with __set filters
    ->rule('confirm-password', 'matches', array('password'));

// this is the array of values that will be set (notice that the model never even knows about password confirmation)
$expected = array(
    'username',
    'password',
    // ORM will automatically look for related models
    'profile' => array(
        // Notice that the address will not be saved
        'name',
        'aim',
    ),
);

$user->values($_POST['user'], $expected);
try{
    $user->save();
}catch (ORM_Validation_Exception $e){
    $errors = $e->errors();
}

// the errors array will look something like this (including an example with many to many errors)
$errors = {
    user: {
        username: 'This field is required.'
        password: 'This field must be at least 6 characters long.',
        profile: {
            aim: 'This is not a valid AOL AIM screen name.'
        }
        occupations: [
            {
                'job_title': 'This is not a valid job title',
                'description': 'This field is required'
            },
            {
                'job_title': 'This field is required'
            },
        ]
    }
    _external = {
        'confirm-password': 'This field must match the password field.'
    }
}