Regulatory Constraint
A legal requirement that removes design options — and one that must be established early, because it is not negotiable and is expensive to retrofit.
The categories that most often reshape an architecture: data protection (GDPR and its relatives, bringing erasure, portability, consent and lawful-basis obligations), residency, sector rules (PCI DSS for card data, HIPAA for health, financial-services regimes with audit-trail and record-retention requirements), and accessibility.
Two properties make them different from other requirements. They are not negotiable — you cannot trade compliance for time to market — and several of them conflict with architectural patterns you might otherwise choose: the right to erasure against an immutable event log or an append-only audit trail, residency against a single global database, retention against a privacy-driven deletion policy.
Which is why the compliance conversation belongs at the start. A design reviewed against them at the end is a design that gets rebuilt.