Green flags
They ask detailed questions about how the work is done today and who does it. They suggest starting small. They can show systems they built running in production, with results measured in hours saved, response times or revenue. They explain the risks and how they will be controlled. They are clear about who owns what after the project.
Red flags
Guaranteed results, vague promises of transformation, a single tool proposed for every problem, everything running on the agency's own accounts, no mention of data protection, and no plan for maintenance. Also be wary of impressive demos built on sample data that never touch your real systems.