A constrained intermediate with permittedSubtrees of dNSName: example.com can issue only for example.com and its subdomains; adding an excluded subtree removes specific names. Verifiers apply the constraints to every certificate below the CA during path validation (RFC 5280 §6.1.3).
It is the safe way to delegate issuance: an organization can receive a technically constrained intermediate for its own domains, and the CA/Browser Forum treats such sub-CAs differently in audit requirements. Support used to be patchy (some clients ignored the extension or failed on critical name constraints), but modern browsers, OpenSSL, Go and Java enforce it.
Pitfalls: constraints on DNS names do not automatically cover a host name placed only in the subject commonName, so verifiers that still read CN can be fooled, and IP constraints need both an address and a mask.