You'll see one request at a time. Decide fast: is it uncontrolled, unauthorized scope expansion, or is it something else — a defect fix, an approved change, or a formal request going through change control? Four rounds, each faster than the last.