I've found requirements do not change nearly as often as you would think. Only maybe 10% of the changes I make come from a requirements change.
Take for instance the articles permissions example. Is that a change in requirements or a lack of understanding the requirements and domain?
Sometimes it is a genuine requirements change. Maybe the company has recently adopted a new security policy, or maybe you are selling to a new customer and they require permissions even though none of your existing customers do etc. More often than not though the requirement has always existed but the dev team didn't know about it or didn't have time to deal with it.