Is It Out of Scope? — Web development
Is adding a members-only login area out of scope for a web development project?
Yes. Authentication is a real feature with security implications (password handling, session management, access control) — never a minor add regardless of how the request is phrased.
The build was scoped without authentication. A request to "just add a login" for a members area is one of the more commonly underestimated out-of-scope asks — authentication touches user data models, password storage/hashing, session management, access-control logic on every gated page, and usually password-reset flows with their own email/token handling. None of it is optional to do properly, and none of it is small.
Is it out of scope?
Yes, and it's a real feature with genuine security surface area — this is a case where doing it as a rushed, unscoped add is a genuine risk (weak session handling, improperly hashed passwords), not just a billing issue. Worth being firm about needing to scope it properly.
Clause typically implicated
Clause typically implicated
Deliverables clause→ — Authentication and access control are core architectural features that must be named in the original feature list to be in scope — never assumed as an incidental add.
Example contract wording
Example contract wording (illustrative, not legal advice)
Authentication wasn't part of the original build — adding it means new data models, secure password handling, session management, and access control on every gated page, which is real feature work with security implications I'd want to get right rather than rush. I'd like to scope this formally — can we talk through what members need access to?
How MarginFlow flags it
MarginFlow flags authentication requests outside_scope with high confidence and, given the security stakes, the explanation explicitly recommends proper scoping rather than a quick estimate — a case where the classifier's output is meant to slow the account manager down a little, not just help them bill for the work.