Constraints may become invalid after initial creation

As constraints are validated on the client and then sent to the provisioning agent to actually deploy machines, there is a window where a provider may change what constitutes a correct value without juju detecting it. As errors from the provisioning agent are not clearly reported back to the client,

A bigger issue is likely to come from constraints associated with services, which are then either respawned automatically or have new units added, perhaps a considerable time after initial creation.

This is a particular issue for the MaaS provider which has generic tag constraints that are configurable per deployment, and are liable to be added, removed, and changed across the lifetime of a service.