I was thinking more about my experience in corporate settings.

Hardware needs to be procured or implemented in the cloud - there's a lot of work on the architectures and costs early in projects so as to ensure that things will cost in. Changing that can invalidate business cases, and also can be very difficult due to architectural and security controls.

In terms of users, in corporates the user communities must be identified, trained, sometimes made redundant, sometimes given extra responsibilities. Once you have got this all lined up any changes become very hard because suddenly, like a ripple over a lake when a pebble is dropped in, everyone who's touched has a reason why they are going to miss targets (you are that reason) and therefore want 100% bonus (there is no money for 100% bonus for all).

In previous jobs I would have delighted in pointing out that if there are no users the system can't be funded!

I agree that working without a spec is madness, it's just not realistic in the real world either. People expect you to stand behind a commitment to deliver, they also want to know what they are paying for. However, things do change, both really (as in something happens and the system must now accomodate it) and also due to discovery (we didn't know, we couldn't have known, but now we know and must accomodate this knowledge). It's really important to factor this in, although perfect flexibility is infinitely expensive and completely unrealistic...

A bit of flex can be cheap, easy and a lifesaver though.