There seems to be some discussion of this elsewhere on the web, but it's scant on citations to actual regulations or cases. To narrow the scope, let's say that the female employee dresses so that the lack of a bra is not immediately obvious (but is with some scrutiny), that the employee does not regularly interface with customers (there is no official or de facto requirement for a particular appearance associated with the specific position), and that there is nothing in the company's written dress code or employment contract specifically addressing such a requirement (the requirement is only stated verbally by the employer based on anonymous complaints from other employees).
An employer can require any arbitrary employee to wear a bra, or to not wear one, unless there is a overriding contractual clause (a freedom-to-dress clause), or some statutory limit. Such limits can arise from municipal law, state law, and federal law. It is obviously impossible to review all applicable municipal and state laws, which would typically involve the same mechanism as the federal rules.
The underlying federal law pertaining to sex and employment is 42 USC 2000e–2 which most saliently says it is illegal for covered employers
to fail or refuse to hire or to discharge any individual, or otherwise to discriminate against any individual with respect to his compensation, terms, conditions, or privileges of employment, because of such individual’s race, color, religion, sex, or national origin
("Covered" employers are those with 15+ employees for at least a cerrtain period of time).
The bottom-line regulations and hints as to what the law is are in 29 CFR part 1604. There are bona fide occupational qualifications which can allow hiring only males or only females, but they are narrowly construed (can't be based on stereotypes like "females are weaker" so decisions must be based on individual characteristics). There are no specific rules against systematically mistreating females (and not males) in employment, and there is no clear definition of what constitutes mistreatment.
The law does not prohibit restrictions on appearance, and does not limit appearance restrictions only in case of "dealing with the public". The law does allow general rules rather than case-by-case arbitrary decisions, indeed encourages general rules over subjective determinations ("lack of a bra is not immediately obvious"). The rules do not have to be identical for males and females: see Kleinsorge v. Eyeland, 251 F.3d 153, where there were different rules for men vs. women regarding wearing earrings. See cases cited therein, including Knott v.Missouri Pac. Ry. Co., 527 F.2d 1249 ("minor differences in personal appearances regulations that reflect customary modes of grooming do not constitute sex discrimination within the meaning of §2000e-2") and others. See also Jespersen v. Harrah's, 444 F.3d 1104, which held that
appearance standards, including makeup requirements, may well be the subject of a Title VII claim for sexual stereotyping, but that on this record Jespersen has failed to create any triable issue of fact that the challenged policy was part of a policy motivated by sex stereotyping
In Gerdom v. Continental, 692 F.2d 602, the issue was weight requirements imposed on females but not males, and Continental was found to have illegally discriminated because "it merely declares the company's determination to impose this requirement on employees because they are females", also noting that "gender-based discrimination cannot be upheld on the basis of customer preferences unrelated to abilities to perform the job".
The basic logic of such a case is that a plaintiff could allege sex discrimination in a practice, then the defendant would have to offer a non-discriminatory rationale. If the rationale seemed credible (that is, the reason was something other than just "we want females to wear bras"), the defendant would probably prevail.
As to the question of whether anonymous employee complaints could constitute a sufficient rationale, that is hard to judge in lieu of case law, but I doubt that such an argument would fly. Such a rationale could possibly address a legitimate interest of a business. Issues of employee morale or distraction and hostile workplace are legitimate business concerns, but a single anonymous complaint would hardly establish that there is a real problem for the business to address. A massive outcry from the workforce could make the concern look more credible, especially if it were based on a "deeply held value" of said employees, and there was a believable threat that a substantial chunk of the workforce would leave if the situation was not remedied. An anonymous complaint (or multiple complaints possibly from the same person) would not make such a "threat" credible.
One limit on an employers legitimate business interests is that they must give way to making reasonable accommodation to an employee's religious requirements (EEOC v. Abercrombie & Fitch). If an employee objected to working in the same room as a braless female, for some religious reason, then reasonable accommodation to that consideration is necessary. The most reasonable accommodation is allowing the offended employee to work in a different room. Things get more complicated if, for some reason, that accomodation is impossible or highly impractical. In order to successfully invoke the religion card, a complainant must provide evidence of an actual religious need. In Swartzentruber v. Gunite Corp., 99 F.Supp.2d 976, plaintiff wished to argue that he had a religious right to display KKK tattoos such as the "Firey Cross". But,
Swartzentruber does not present admissible evidence, or even contend without evidence, that being required to cover up his tattoo at work conflicts with his religious beliefs, or that he told Gunite about any conflict with his beliefs and Gunite's demand that he cover his tattoo
Even if the employer had been put on notice about the religious claim and the complainant had substantiated the claim at trial, that does not give an emplyee a right to do whatever they want:
the court agrees with Gunite that any greater accommodation would cause it an undue hardship. Gunite demanded that Mr. Swartzentruber cover his tattoo because it violated Gunite's racial harassment policy and offended other employees. Gunite accommodated his tattoo depiction of his religious belief that many would view as a racist and violent symbol by allowing him to work with the tattoo covered; Title VII doesn't require more.
Employers are permitted to maintain reasonable dress codes for employees in the workplace. Absent evidence of discrimination vis-a-vis male counterparts, in all likelihood (though laws differ by jurisdiction) the employer is certainly entitled to make this a requirement.
There does not have to be a specific rule on this if it states that employees must dress reasonably.
That said, your question seems to propose a basic impossibility. If the employer has not said anything, then evidently she may continue doing what she's doing. If the employer has said something, then it is either not the case that the “lack of bra is not immediately obvious” or someone has spent enough time examining the “situation” or doing so in such a way as to notice that lack of bra, that she may have a sexual harassment claim.
So, the federal law you're going to look at is Title VII of the 1964 Civil Rights Act. Generally,
"an employer may adopt a grooming/appearance policy in accordance with generally accepted community standards that differentiates between men and women (specific requirements may differ) provided it is applied in an even handed manner and does not impose an unequal burden on one sex over the other"
For example, requirements that women wear makeup have been upheld. Employees may challenge facially valid grooming policies on the basis of selective enforcement, though. If a policy has a disparate impact on a certain group, it must be job-related and "consistent with business necessity.
A case that may help the person in the situation you describe, however, is EEOC v. Abercrombie and Fitch. Even there, though, that turned on a religious requirement, after the store refused to hire a girl because she showed up with a head scarf to her interview. To the best of my knowledge, I am simply not seeing an instance, especially with the makeup requirement being upheld as legal, in which it would be unreasonable for an employer to make that a requirement. I'm of course open to read anything anyone else puts forth.
All quotes above are attributed to: http://www.clipular.com/c/4717878596337664.png?k=e54T8CxrMOMg4XsZYNWWyLBn2DE.