That sounds like poor BA/spec work. BA asks: "what do we need from this username". BA should ask "what do we need from usernames overall"?
It's always going to be hard to be agile on federal contracts - there're too many customers to really get a clear view from them.