I work as the head of a small team of developers for a business with around 100 employees. Our core work is handed to me by directors which I then assign to a developer (either myself or one of the others in the team). On top of our core work users will make change or feature requests.
There is currently no formal process for requests and the majority of these are made either by email or someone coming over to our desks. I have told the other developers that such requests should be passed on to me and I will then decide whether we can take on the work or if it needs to be escalated to a director for approval/rejection.
The problem with this approach is that users will target specific developers, go to their desk and say that they need changes doing urgently - stating things such as 'I have a meeting tomorrow morning, it is crucial this change is made by then.'
Despite what I have told the other developers about not taking on work without speaking to me first they sometimes cave under the pressure, which I can understand - it is difficult to say no to someone when they refuse to take that for an answer and stand at your desk demanding you do what they ask.
These under the radar changes result in rushed code which is not reviewed risking the introduction of security vulnerabilities and/or bugs. They also distract from core work which is typically of much higher priority.
My current idea is to introduce a formal system where requests are put in to a queue to be reviewed in our weekly development meeting. Anything a user considers to be urgent could be flagged as such and would be reviewed before our weekly meeting to see if immediate action is needed.
I can foresee resistance to this with users being reluctant to make requests in this formal way, seeing it as a way of us getting out of doing work, and wanting an explanation as to why this change in process has been made.
There is also the issue that users typically view all of their requests to be of high urgency and importance - I can imagine the majority of requests made would be flagged as 'urgent' when they are not necessarily.
How can I explain the situation and need for a formal request system to users without provoking a hostile response? Also how can I try to prevent users from incorrectly flagging requests as urgent?