Isn't code what defines the constraints though?

The domain and delivery/ops context define the constraints, code that gets written ought reflect those constraints, not provide more.