What kind of security constraint can always be legally enforced on an organization?