How to choose a Claude Code agency
Choose the firm that can explain, in specifics, how it will configure permissions, protect secrets, connect CI and measure results in your repositories. General enthusiasm about AI coding is not evidence of skill. The questions below separate teams that do this work from teams that have read about it, and they are the questions BlackCard is glad to answer on a first call.
Start with the problem, not the vendor
Decide which of three problems you have. If engineers lack access or the security team has yet to approve the tool, you need setup and rollout help. If access exists but usage is shallow, you need training. If you want software delivered and care that the codebase is ready for agents afterwards, you need build work.
Most teams have more than one of these problems, so the safest choice is a partner that covers all three. Configuration, training and delivery inform each other, and one team that does them together keeps them consistent.
BlackCard covers all three for small and mid-size companies. One senior team sets up Claude Code, rolls it out, trains your engineers and builds business software, automated workflows and AI agents with it. Put the questions below to BlackCard on a free 15-minute call.
Questions on security and permissions
| Ask | A good answer mentions |
|---|---|
| How will you stop the agent from touching production credentials? | Deny rules for sensitive paths and commands, hooks that block edits to protected files, and secrets kept out of the working directory |
| Which controls can an individual developer override? | Managed settings deployed by administrators, which user and project settings cannot override |
| How do you treat instruction files versus enforcement? | That CLAUDE.md guides behavior but is not enforced, while permission rules and hooks are enforced by Claude Code itself |
| How do you vet MCP servers? | A reviewed allowlist, one team owning the shared .mcp.json, and caution with servers that fetch untrusted content because of prompt injection risk |
| Which permission modes will teams use, and where? | A default for daily work, stricter settings for sensitive repositories, and a policy on modes that skip prompts |
Questions on CI integration
- Which workflows will run Claude Code in CI, and what triggers them: mentions in pull requests, labels or a schedule?
- How will the CI job authenticate: an API key stored as a secret, or your cloud provider's identity federation?
- What limits are set on turns, runtime and spend per run?
- Who can trigger a run, and how are pull requests from forks and bots handled?
- Does agent-written code go through the same review and branch protection as human-written code?
Questions on measuring impact
Ask what will be measured before the pilot starts and who owns the numbers. Good answers use delivery metrics you already track, such as cycle time, review turnaround, change failure rate and test coverage, compared against a baseline from the same team.
Be skeptical of a single headline percentage. Self-reported productivity gains vary widely by codebase and task type. A credible firm will tell you where the tool did not help as well as where it did.
Red flags
- No mention of permission rules, managed settings or hooks when you ask about security.
- A recommendation to run every session with permission prompts bypassed.
- Guaranteed productivity numbers before anyone has seen your code.
- Slides and strategy, with nobody who will work in your repositories.
- Training with no hands-on time in your own repositories.
- No named people: you cannot find out who will actually do the work.
Check the references that matter
Ask to speak with an engineering lead at a client of similar size, not a sponsor from the leadership team. The useful questions are simple: what was in place after eight weeks, what the team still uses six months later, and what they would not pay for again.
Also ask to see how a delivered repository is set up for agents: its instruction files, test commands and CI checks. A team that builds with Claude Code every day, as BlackCard does, can walk you through one on a call.
Common questions
Can one agency handle setup, training and build work?
Yes, and it is the better arrangement. BlackCard sets up Claude Code, trains your engineers and builds software with it, all with one senior team. The configuration you receive is the one the team trusts in its own delivery work.
Is a tool-neutral agency better than a Claude Code specialist?
It depends on your teams. If developers already use several assistants, a tool-neutral firm can set shared rules across them. If you have standardized on Claude Code, a team that works with it every day, such as BlackCard, will go deeper on its permissions, hooks and MCP configuration.