cardinality constraint