Is It Out of Scope? — Web design
Is adding SSO / enterprise login out of scope for a web design project?
Yes. Single sign-on is a security-critical authentication feature requiring real engineering and identity-provider integration — not something a design engagement builds, even where the design covers what the login screen looks like.
A client planning to sell to enterprise customers often needs to support single sign-on (SSO) — letting users log in through their company's identity provider (Okta, Azure AD, and similar) rather than a separate username and password. It's frequently framed as a small login-page tweak, but it means integrating with SAML or OIDC protocols, handling provider-specific configuration, and building the flows for what happens when that integration fails.
Is it out of scope?
Yes. Designing what a login or SSO entry screen looks like is design work; building the actual SSO integration is a security-sensitive engineering feature well outside a design engagement's scope, and one where cutting corners has real consequences.
Clause typically implicated
Clause typically implicated
Deliverables clause→ — Scopes the project to design deliverables — SSO is authentication infrastructure requiring identity-provider integration, well outside a design scope regardless of how the login screen itself is designed.
Example contract wording
Example contract wording (illustrative, not legal advice)
I can design what the login/SSO screen looks like, but the actual SSO integration — connecting to your customers' identity providers, handling the SAML/OIDC flows, and building fallback behavior — is a security-sensitive engineering feature outside our design scope. I'd strongly recommend a developer with SSO experience handle that piece.
How MarginFlow flags it
MarginFlow flags SSO requests outside_scope on design contracts and, given the security stakes, the explanation explicitly recommends proper engineering rather than a quick fix — similar to how MarginFlow treats other authentication requests, since the risk of a rushed SSO implementation is real and worth the account manager flagging clearly to the client.