I’ve seen this happen on almost every enterprise project I’ve worked on. The biggest issue is that different departments all have legitimate concerns. Security wants authentication, compliance asks for audit logs, operations needs reporting, and business teams request integrations because they expect the MVP to fit existing workflows. Individually, each request seems reasonable, but together they completely change the scope. I found an interesting explanation of this while reading https://roobykon.com/mvp-development, especially the part about balancing validation with enterprise requirements. In my experience, having a clearly defined success metric for the MVP and a strict "not now" list helps keep everyone focused on proving the core assumption first.