Founders shopping for a product agency often ask the wrong commercial question first: "What is your hourly rate?" Rate shopping without a contract shape is how you buy either a sandbagged fixed price or an open-ended burn that feels busy and ships little. The better question is how risk is shared when scope is still learning — fixed price, time-and-materials, or milestone billing with clear acceptance tests. This is a buyer-side guide for founders hiring an agency to build web apps, mobile apps, AI features, SaaS, or healthtech products: which contract shape fits discovery versus delivery, how to write milestones that survive contact with reality, and red flags that turn "fixed price" into an endless change-order war. If you have not yet decided who should build it, start with agency vs freelance vs in-house ; if you need a budget range first, see how much an MVP costs in 2026 . Treat commercials as product risk management, not procurement trivia. The SOW is part of the product, not paperwork after the handshake.
Match the contract to uncertainty, not optimism
Fixed price fits when the outcome is crisp: a defined MVP cut list, named integrations, environments you control, and acceptance tests both sides can demo without arguing. Time-and-materials fits exploration — ambiguous workflows, unknown vendor APIs, compliance discovery, or a rescue where the first weeks are archaeology. Milestone billing is the hybrid most product builds need: discovery as a short fixed or capped phase, then delivery milestones tied to working software in your accounts. Optimism bias kills fixed-price deals. If neither party can write a "done" checklist today, you do not have a fixed-price project yet. You have a discovery project pretending to be delivery, and someone will pay for the pretending — usually you, through change orders, quality cuts, or a bitter "final" sprint that is neither final nor done. Honest uncertainty is cheaper than fake certainty.
How to write milestones an agency can actually hit
Each milestone needs a user-visible outcome, an environment (staging versus production), data assumptions, and an explicit out-of-scope list. "Owner can invite one member, charge a test-mode subscription, and complete the core workflow" beats "Sprint 3: auth + billing + AI." Prefer vertical slices over horizontal layers that leave you with beautiful APIs and no shippable UI for customers to touch. Put change control in the SOW: who can approve scope adds, how estimates update, lead time for third-party dependencies, and what happens when an App Store review or EHR sandbox slips. Agencies that refuse change control either sandbag the price or eat silent overtime. Both hurt the product and the relationship. Name the Must column and park Nice items with dates so "can we also" does not silently rewrite the contract mid-build.
Fixed-price traps founders should refuse
Watch for fixed price with open-ended "unlimited revisions," no acceptance tests, IP or cloud accounts left with the agency, and AI features priced as a line item without eval criteria or human-in-the-loop scope. Also refuse dual-track promises — "we will rewrite and keep shipping features" — without separate budgets. That is two projects sharing one number and one scapegoat when both slip. Ask who owns GitHub, cloud, domains, and app-store accounts on day one. Commercial clarity without operational ownership is still lock-in. A cheap fixed price that leaves production on the agency's team seat is not cheap; it is a future migration invoice wearing a discount sticker. If the agency cannot move the work into your orgs in week one, pause before you pay for month three.
A simple commercial ladder that works
Weeks 0–2: capped discovery — ICP workflow, auth and billing choices, compliance constraints if you are in healthtech, and a Must/Nice cut list with acceptance language both sides can demo. Then quote delivery as milestones with demoable outcomes. Keep a small T&M or contingency bucket for unknowns you already named: EHR sandbox delays, store review, vendor SSO, or a migration slice that needs more archaeology than the audit caught. Measure the agency on whether milestones land working software in accounts you own — not on slide decks or "velocity" stories. That is how CodeFlamme structures founder engagements so growth spend buys shipped product, not burn-rate theatre. Revisit the commercial shape if discovery reveals the product is a rewrite, not a feature build. Do not force a fixed-price delivery quote on top of an unresolved architecture question.
Questions to bring to the sales call
What is in the first demoable milestone, and what is explicitly out of scope? How do change orders work, in writing? Who owns the repos and cloud on day one? What happens if a third-party dependency slips? How will AI work be accepted if it is in scope — with evals and kill criteria, not vibes? What does "done" look like for billing, auth, and the core workflow? If answers are vague, keep shopping. The right commercial structure will not remove product risk. It will make risk visible early enough that you can still steer the build — which is the whole point of hiring an agency instead of hoping a freelancer remembers your edge cases after the invoice clears.
