Is It Out of Scope? — Web development
Is adding SSO / enterprise login out of scope for a web development project?
Yes, unless it was named in the original feature list. SSO means integrating with external identity providers, handling SAML/OIDC protocols, and building secure fallback behavior — a substantial security-sensitive feature, not a config toggle.
The build shipped with standard email/password login. As the client starts selling to bigger customers, they're asked for SSO support — letting enterprise users authenticate through their own company's identity provider. This means integrating with SAML or OIDC, supporting multiple identity providers with different quirks, and handling what happens when the provider connection fails, on top of whatever login system already exists.
Is it out of scope?
Yes, unless SSO was named as a requirement in the original SOW. This is a substantial, security-sensitive feature — real protocol integration work, not a setting to flip — and worth being firm about scoping properly given what's at stake if it's implemented carelessly.
Clause typically implicated
Clause typically implicated
Deliverables clause→ — Lists the specific authentication features built — SSO/identity-provider integration has to be named explicitly given the protocol work and security implications involved.
Example contract wording
Example contract wording (illustrative, not legal advice)
SSO wasn't part of the original feature list. Adding it means integrating with SAML/OIDC identity providers and building secure fallback handling — real security-sensitive work I'd want to scope and estimate properly rather than rush. Can we talk through which identity providers you need to support first?
How MarginFlow flags it
MarginFlow flags SSO requests outside_scope with high confidence and, given the security stakes, the explanation explicitly recommends proper scoping over a fast estimate — a case where the classifier's output is meant to slow the account manager down deliberately rather than just help them bill for the work.