Is It Out of Scope? — Web development
Is adding new user roles and permissions out of scope for a web development project?
Yes, unless it was named in the original feature list. A permissions system means defining roles, enforcing checks throughout the application, and testing every access path — real, security-relevant work, not a config flag.
The build shipped with a single kind of logged-in user. As the client's needs grow — often once they have a bigger team using the tool — they ask for different permission levels: someone who can view but not edit, someone who can manage users, and so on. Adding this properly means defining the roles, enforcing access checks everywhere they're relevant, and testing that nothing slips through.
Is it out of scope?
Yes, unless multiple roles or permission levels were named in the original SOW. This is genuine, security-relevant application logic — getting it wrong means either broken functionality or, worse, someone accessing something they shouldn't — worth scoping and testing properly rather than bolting on quickly.
Clause typically implicated
Clause typically implicated
Deliverables clause→ — Lists the specific access model built — additional roles and permission levels have to be named explicitly given the security implications of getting access control wrong.
Example contract wording
Example contract wording (illustrative, not legal advice)
Multiple user roles weren't part of the original scope — the build has one access level. Adding roles means defining what each one can do, enforcing that everywhere it matters, and testing thoroughly since access-control bugs are the kind of thing you really don't want to ship. I can scope this properly; can we talk through what roles you actually need?
How MarginFlow flags it
MarginFlow checks the extracted feature list for any mention of multiple roles or permission tiers before classifying — where the build was scoped around one access level, the request is flagged outside_scope with an explanation emphasizing the security stakes, which tends to help the account manager push back on rushed timelines for this kind of work.