Before You Hire an AI Agent Consultancy

Hiring an AI agent consultancy requires verifying five things before you sign: who owns the agents when the engagement ends, where they run, what security boundaries exist, how transparent the pricing is, and what the handoff includes. Armada Works is an agent-first consultancy that deploys Claude Code agent fleets into client codebases, so this checklist is written from that perspective. The goal is not to sell our model. It is to give you concrete verification steps you can run against any firm in the space, including ours.

This post is not a comprehensive evaluation guide. For that, see how to evaluate an AI agent consultancy. This is a shorter, action-oriented checklist: what to prepare, what to ask, and what to verify before you commit.

Before the Call: Three Things to Settle Internally

Most founders waste their discovery call because they have not clarified three things internally.

Name the bottleneck

"We need AI" is not a brief. "Our content output is one post per month and we need eight" is. "Outbound is zero because nobody has time to prospect" is. The more specific the bottleneck, the faster any consultancy can tell you whether agents are the right solution. If you cannot name the bottleneck in one sentence, you are not ready for the call.

Define your ownership requirement

Do you want to own the agents and run them yourself after the engagement? Or do you want managed operations indefinitely? These are different engagement shapes with different costs. At Armada Works, the Transfer tier ($10,000 to $20,000) is a build-and-handoff. The Operate tier ($5,000 to $12,000 per month) is ongoing managed operations. Knowing which one you need before the call saves 15 minutes of qualification.

Know your stack

The consultancy will ask what tech stack you run, whether you use git, and what CI/CD pipeline exists. If the answer is "we don't have a codebase," most agent consultancies are not the right fit. A SaaS platform is. If you do have a codebase but it is not in a state where agents can commit to it safely, see is your codebase ready for AI agents for a self-assessment.

Five Things to Verify on the Call

These are yes-or-no questions. If the answer is not a clear yes, ask why.

Do the agents run in my repository?

Real agent consultancies deploy agents that commit their work to your git repository. Every action is a commit. Every output is a file you can read, edit, or revert. If the consultancy runs agents on its own infrastructure and delivers results by email, Slack, or a dashboard you cannot inspect, you are buying a SaaS with a services label. For more on why git-based coordination is the load-bearing pattern, see how the agent fleet actually coordinates.

Do I own everything when the engagement ends?

The agents, the prompt files, the state files, the coordination logic, and the dashboard should all live in your repository. If the consultancy retains any of these components, you are not getting a handoff. You are getting a dependency. Ask explicitly: "If I cancel today, what files do I walk away with?" The answer should be: all of them. For a complete checklist of what a real handoff includes, see the AI agent handoff checklist.

Is the pricing published?

Published price ranges are a signal of confidence. If a consultancy requires a custom quote before revealing any numbers, comparison is harder. Look for clear tier definitions. Armada Works publishes three tiers: Pilot ($2,500 to $4,000, one agent, one week), Operate ($5,000 to $12,000 per month), and Transfer ($10,000 to $20,000, build-and-handoff). The Pilot fee credits 100% toward the longer engagement if you continue within 30 days. The ranges are public before you book. See the full pricing structure.

What security governance exists?

This question became non-negotiable after Black Hat 2026. Researchers demonstrated a remote code execution attack against Claude Code, Gemini CLI, and Codex through poisoned GitHub issues. Elastic Security Labs published a separate macOS post-mortem where Claude Code was the parent process in a credential exfiltration.

Ask three specific things:

• What permission model do the agents run under? The right answer: read-only by default, with narrow write allowlists per agent.
• What blocks destructive commands? The right answer: pre-commit hooks, not trust.
• How are credentials scoped? The right answer: per-agent, not shared.

Robert Cowherd, founder of Armada Works, treats security posture as a first-round filter: "If a consultancy cannot show you the hook file that blocks rm -rf and the allowlist that controls what each agent can write, they are running their fleet on trust. Trust is not a security model."

For a practical audit checklist you can run yourself, see the security audit every AI agent fleet needs. For the broader governance landscape after the Black Hat findings, see agent governance after Black Hat 2026.

Is there a pilot option?

If the only way to start is a multi-month contract or a six-figure commitment, the consultancy is optimizing for commitment over fit. A pilot (one agent, one to two weeks, a defined scope) lets both sides test the working relationship before scaling. The pilot should produce a working agent, a runbook, and enough evidence to decide whether a longer engagement makes sense. At Armada Works, the Pilot runs $2,500 to $4,000 and delivers one deployed agent with a handoff document.

The Decision Scorecard

Use this as a checklist after your discovery calls. Score each consultancy you evaluate.

• Agents commit to my git repository: yes / no
• I own all agents, prompts, and state files at exit: yes / no
• Pricing is published before the first call: yes / no
• A pilot option exists (under $5,000, under two weeks): yes / no
• Security governance is documented (hooks, allowlists, credential scoping): yes / no
• Handoff scope is defined (deliverables, timeline, format): yes / no
• The consultancy can show a running fleet or a real engagement: yes / no
• No invented metrics ("4x faster," "73% reduction"): yes / no

A consultancy that scores yes on all eight is worth a second call. One that scores no on ownership, security, or the pilot option is one to pass on, regardless of how polished the pitch. For a deeper list of warning signs, see red flags when evaluating an AI agent consultancy.

What to Read Next

This checklist covers the pre-signing verification. For deeper evaluation criteria, see these companion posts:

• How to evaluate an AI agent consultancy: the comprehensive buyer guide
• Red flags when evaluating an AI agent consultancy: warning signs that indicate the engagement is not what it appears
• What to look for in an AI agent implementation partner: operational maturity criteria beyond this checklist
• How to evaluate AI agent ROI before signing a contract: the business-case framework for justifying the spend

Frequently Asked Questions

What is the difference between an AI agent consultancy and a dev shop?

A dev shop builds software to spec and hands it off. An AI agent consultancy deploys agents, operates them alongside your team on a recurring cadence, and transfers the running system when you are ready. The deliverable is not just code. It is an operating system for the bottleneck you named on the first call. For a detailed model comparison, see what is an agent-first consultancy.

How much should an AI agent pilot cost?

Pilot pricing across the market ranges from $2,000 to $10,000 depending on scope. At Armada Works, a Pilot is $2,500 to $4,000 for one agent deployed over one week. The Pilot fee credits 100% toward a longer engagement if you continue within 30 days. If a firm prices the pilot above $10,000, you are likely paying for sales overhead, not delivery.

What if the consultancy does not offer a pilot?

Ask why. Some firms skip pilots because their minimum engagement is large enough to justify the overhead. That is a business decision, not necessarily a red flag on its own. The red flag is when there is no way to verify the working relationship before committing to a six-figure contract. If you cannot test the fit in two weeks or less, negotiate a kill clause.

Can I use this checklist for SaaS platforms too?

Some of the questions apply. Ownership, pricing transparency, and security governance matter regardless of the model. But the git-integration and handoff questions are specific to consultancies that deploy into your codebase. SaaS platforms operate on vendor infrastructure by design, and the tradeoff is speed of setup versus depth of customization. For a comparison, see agentic marketing SaaS vs. consultancy.

How do I tell if a consultancy's agents are real or just automations?

Ask for a sample daily brief or a commit history from a running fleet. Real agents produce contextual output that changes based on what they find. Automations produce the same output shape every time regardless of input. If the consultancy cannot show you a git log with agent-authored commits, the "agents" are likely scripts with an AI wrapper. For a deeper look at what real agent output looks like, see what Claude Code agents actually do all day.

---

If you are ready to run this checklist against a real engagement, book a discovery call. Thirty minutes, no commitment, no follow-up sequence. We will tell you whether agents are the right fit for your bottleneck.