How a software engagement is contracted decides who carries the risk when scope changes. There are four common models, and many projects combine two of them.
Fixed scope
An agreed price for an agreed scope. The supplier carries the scope risk, so the scope has to be written down in full before work starts. It suits discoveries, proofs of concept and minimum viable products with clear boundaries. Changes go through change requests.
Time and materials
You pay for the time the team spends, and you can reprioritize every sprint. You carry the scope risk in exchange for flexibility. It suits products whose scope will change as you learn from users.
Dedicated team
A stable, cross-functional team for a monthly fee, usually for six months or more. The backlog is yours to reorder; risk is shared. It suits long-running product development with a roadmap rather than a fixed scope.
Team augmentation
Engineers join a team you already run, under your management and process. You carry the delivery risk. It suits adding specific skills or capacity quickly.
Combining them
A common pattern is a short fixed-scope discovery that produces a plan, followed by a dedicated team for the build. The discovery caps the early risk; the team keeps the flexibility the build needs.