That's going to be up to the business building the logic. Ideally those assumptions are clearly encoded in an easily readable manner but at the very least they should be captured somewhere code adjacent (even if it's just a comment and the block of logic to enforce those restraints).

How to make a crap system that users will hate: Let some architecture astronaut decide what characters should be valid or not.