If variable key aQ = 1, that means the key maps plaintext a to ciphertext Q.
clearly, not all assignments to these 729 variables represent valid keys, so we augment the "subject to" part of our integer program by requiring that for any letter x, subject to: every plaintext letter must map to exactly one ciphertext letter, and every ciphertext letter must map to exactly one plaintext letter.