My favorite protection for this kind of situation is having a Single Point of Contact clause, that basically says: "ultimately, we take direction from X person

My favorite protection for this kind of situation is having a Single Point of Contact clause, that basically says: "ultimately, we take direction from X person and only X person". This helps in a couple of different ways. Occasionally, you'll get conflicting requests or instructions from a client. When that happens, I usually just push it to the single point of contact and ask how they want to proceed. But it also helps in the scenario you outlined, because I make sure any approvals for "outside the scope of SOW work" gets approved to be worked by the single point of contact, along with any relevant disclaimers about total project budget and estimate. Then, when you come to time to evaluate the project progress the single point of contact has clear language that they've approved with whatever associated cost warnings.