AI safety enforcement in deployed systems relies overwhelmingly on advisory constraints: rules the system is instructed to follow, enforced by mechanisms that are separable from the computational substrate that produces decisions. This paper introduces a formal distinction between advisory constraints and structural constraints, in which reasoning that omits or fails a required constraint evaluation is computationally undefined rather than prohibited. We provide precise definitions of both constraint classes for AI decision systems, prove that advisory constraints are necessarily bypassable under a defined adversary model, prove that structural constraints eliminate the bypass vulnerability, and show that structural constraints reduce the AI safety enforcement problem from two independent challenges (correct specification AND reliable enforcement) to one (correct specification alone). We analyze the implications for current regulatory frameworks including the EU AI Act, the U.S. DoD AI Ethical Principles, and the interagency SR 26-2 model risk management guidance, and identify the conditions under which each regulatory framework's requirements can and cannot be satisfied by advisory enforcement alone. We are precise about the limitations of structural constraints: they guarantee enforcement of whatever is specified but do not guarantee that the specification is correct or complete. The specification problem remains open and is equally difficult under both approaches.