Password constraints below tenant level