Claude Code consulting: what to look for before you hire anyone

Hire a Claude Code consultant on evidence of operation, not evidence of building. Anyone can now produce a working demo in an afternoon. The scarce skill is running that software for months without it quietly breaking. Five questions, none needing technical knowledge, separate people who have operated systems from people who have only shipped them.

Claude Code collapsed the distance between “described” and “built”. One operator with it can now ship what used to take a team: real applications with auth, databases, deploy pipelines, and documentation. That collapse created a consulting wave, and most of the wave is people who have automated a demo, not an operation.

Why the tool raised the bar for hiring

Claude Code makes building cheap, so building no longer proves competence. What proves it is judgment about scope, permissions, review, and failure. Buyers should test for those, because the tool now hides their absence better than any earlier generation of software did.

Two published findings show why. In July 2025, METR ran a randomized trial with 16 experienced open-source developers across 246 real tasks. The developers took 19% longer with AI tools allowed, yet afterwards believed they had been 20% faster. METR is careful about the limits: it was early-2025 tools in one setting, and it does not claim AI never helps.

The lesson for a buyer is narrower and more useful. Felt speed and actual outcomes can point in opposite directions, and a consultant who only reports how fast it felt is telling you nothing.

Veracode’s 2025 GenAI Code Security Report, updated in October 2025, tested over 100 large language models on coding tasks in four languages. AI-generated code introduced risky security flaws in 45% of tests. Bigger models did not fix it. Review is not optional, and someone has to own it.

1. Ask what they run for themselves

Ask every candidate what they operate in production for their own business today. A specific answer with numbers and dates is the strongest signal available, because it comes from someone who has paid for their own mistakes. Vague answers about “client work under NDA” tell you nothing you can check.

Builders who use these tools on their own operations have felt the failure modes with their own money. Our own answer is on the proof pages: a 41-agent fleet running a three-company group, 5,450 runs, zero failures, 13 days, as of July 2026.

Those figures are a fixed, dated snapshot, and we say so. A snapshot with a date on it can be checked. A claim that a firm “has deployed hundreds of agents” cannot.

2. Ask where the code will live

The only acceptable answer is: in your accounts. Your GitHub organization, your database, your hosting, your API keys, with the consultant added as a collaborator who can be removed. Any variation of “on our platform” means you are renting your own system, and the exit cost is a rebuild.

Gartner’s June 2025 forecast that over 40% of agentic AI projects will be canceled by the end of 2027 makes this practical, not theoretical. Projects get canceled. If the repository sits in the consultant’s account, a cancellation takes the system with it. We wrote up the full test in the handover test.

3. Ask for the definition of done, in writing

A written scope with acceptance criteria keeps speed honest. Claude Code makes building fast, which makes scope discipline more important, not less. A fast builder can generate plausible-looking software well past the point where anyone checks it against what you asked for.

Ask to see a past scope document, with the client details removed. It should list what is built, what is explicitly not built, and how you will know the work is finished. Then ask what happens when you want something outside it. The answer you want is “a new order with its own price”. The answer to worry about is “we will figure it out as we go”.

Fixed price only works if the scope is real. If a consultant will not put the boundary in writing, they are keeping the option to bill you for the ambiguity.

4. Ask how failures surface

Ask what happens when the agent hits input it cannot handle. Anyone can wire an agent that works on the happy path, and the answer to this question is where professionals separate from everyone else. The right answer names validation before the run, checks after it, logging, and a stop-and-ask default.

Silent failure is the expensive kind. Anthropic’s own security documentation reflects the same design instinct: Claude Code starts in Manual mode with read-only permissions and asks before it edits files or runs commands. Anthropic’s October 2025 engineering post on sandboxing reported that sandboxing reduced permission prompts by 84% in its internal usage, and stressed that it needs both filesystem and network isolation to work.

Your consultant should be able to explain that layering in plain words. What can the agent touch? What must a human approve? What happens when it is wrong? Our own version is a tomte, our word for one production agent with one defined job, plus a log entry for every run and a person who sees every exception. The failure modes we hit ourselves are published with the fixes.

Also ask who reviews the output. Anthropic’s documentation states that you are responsible for reviewing proposed code and commands before approving them. A consultant who has automated away all review has moved that responsibility to you without telling you.

5. Ask what happens after handover

Docs a new hire could follow, a recorded walkthrough, and a support window are the baseline. Test it: ask for a sample handover pack. If the builder’s revenue depends on you never understanding your own system, their documentation incentive is exactly backwards.

The handover should also name who holds each credential and how to rotate it. A system nobody can maintain is a system that stops working the first time an API changes or a key expires. Both happen in every production system sooner or later.

The five checks side by side

Score every candidate on the same five rows, in writing, before you compare prices. One weak answer is a reason to keep looking. Two weak answers is a reason to stop the conversation and move on to the next name.

Question	Strong answer	Weak answer
What do you run for yourself?	Named systems, run counts, dates	”Client work, under NDA”
Where does the code live?	Your accounts from day one	”On our platform”
What is the definition of done?	Written scope, acceptance criteria	”We will iterate together”
How do failures surface?	Validation, logs, stop-and-ask	”It rarely fails”
What happens after handover?	Docs, recording, support window	”Call us if anything breaks”

What none of this replaces

These questions filter consultants. They do not make a bad project good, and they do not remove the work on your side: a person in your business has to own the outcome, approve the scope, and read the exception reports.

We also say plainly what is automated today and what is not. Our agents run inside a process with human approval points, and that is the point of the process. If a consultant promises a system that needs no human judgment anywhere, treat the promise as the red flag.

The pattern behind all five

Every check is a receipts test. The tooling is powerful, so the question has moved from “can they build it” to “have they operated it, and will they hand it over cleanly”. Our version of passing that test is the AI Workforce Sprint: fixed price, your infrastructure, written scope, recorded handover. Hold us to the same five questions. The answers are on this site.

Start async

If you want to run these five questions against us, Start async. Tell us what you want built and what your business runs on. We reply in one business day, in writing, with no meetings. You can send the five questions in your first message.