Or they will require such detailed functional specs that by the end you're almost literally just paying for ten fingers to do the typing. An example that I wish weren't true: one specification had detail to the level of specifying that a particular form required a button to submit the form. The returned product had a button titled "Submit the Form." It did nothing, because the specification did not explicitly say to submit the form when the button was clicked.
A web app I inherited, for which I do not have the original spec, and initially developed by an outsourced offshore team, had one route that was literally "/obscure/reset_password?user_id=x". A light dawned when I realized they must have been asked to provide an unguessable or "obscure" endpoint for account actions.
