Who exactly determines the validity of a derived requirement when it must bridge the gap between high-level stakeholder needs and specific technical constraints? Furthermore, these requirements are not explicitly stated by the client but are identified by the engineering team as necessary to satisfy a primary "parent" requirement. How do you ensure that every derived requirement remains strictly traceable back to its origin to avoid unnecessary scope creep?