The question is asked, “what law prevents me from flying my drone over 400 feet?”
DOG predicts that before the end of 2016 this will be in a NOTAM, but as of early 2016 here is the short answer.
For commercial flying, check your Certificate of Authorization (COA) and you will see that you have a 400 AGL ceiling, or possibly lower.
For recreational flying, start with FAA Advisory Circular 91-57A issued September 2, 2015. You can get a copy at the FAA website, or here. You will see that in section (e) it lists the 400 feet AGL ceiling as a best practice. But, when you registered yourself with the FAA (you did register didn’t you?) you promised “I will fly below 400 feet.” A screen shot of your promises are here and on your Certificate of Registration. In order to complete the registration you had to click the promise “I have read, understand and intend to follow the safety guidance.”
What's that you say? You refused to register or you think that forcing you to make this promise in order to register is itself unconstitutional? Good luck with that argument, and lose my number.
So the answer is that right now 400 AGL for recreation is a best practice and you promised to abide by that. For commercial flight it is in your COA. Break that promise and you risk losing your recreational registration (or your busness license). You probably won’t get sent to Guantanamo (unless you fly over the White House), but you will be in a whole mess of trouble.