Thoughts on that topic -> https://mcconnellsoftware.github.io/supporting-the-ten-thous...
https://hipmonkey.wordpress.com/2016/02/08/5-monkeys-a-banan...
Afterwards gently point them towards the familiar examples of passwords (“Passwords can't contain spaces/be longer than 20 characters/must …”), email address validation (“I found this really complete regex that …”), names (“No, surnames are always at least 3 characters long, and …”), and sex/gender (“Haha, yeah I know gender isn't a binary option, but this is the sex field, it just records what's in the user's passport, and THAT is either male or female!”¹).
1: Nope: https://www.dutchnews.nl/news/2018/10/gender-x-first-gender-...
And not everyone has a passport or other standardised ID document.