A woman who runs a small physio clinic opens WhatsApp on Monday and finds her inbox already sorted, two bookings moved and her client list updated. She did none of it. Someone set up an agent for her last week, and she pays that person every month to keep it running.
Why should that someone be anyone but you? You already know your way around a laptop. Meanwhile your own week looks like a manager who never says thank you, a pay rise that keeps slipping to next quarter, and job ads asking for skills that seem to change every month. The work people were told was safe is the first thing these agents are learning to do.
That cuts both ways, and it opens a door. Most small business owners have heard of OpenClaw and have no idea how to deploy it. The guide's own read is that managed hosting platforms arrive within 12-18 months and turn basic setup into a commodity. The people who are known as the OpenClaw person in their town before then keep the retainers. The rest compete on price.
Here is what this page lays out. Setup goes for $500-$2K, ongoing management for $500-$2K/month, and custom skills sell on the marketplace for $50-$500 each. The software is free, so your outlay sits between $0 and $200. Monthly income starts around $2,000 in this guide's range, and 2-4 weeks is a normal run to profit.
Tonight, install OpenClaw on your own machine and point it at your own calendar. Break it, fix it, learn where its authority should stop. Your first client deserves an agent you have already tamed.
In January 2026, a fairly obscure open-source project called OpenClaw passed Linux, Kubernetes and every other repository to become the most-starred project on GitHub. By March 2026, it had 247,000 stars and counting. Nvidia CEO Jensen Huang stood on stage at GTC 2026 and called it "the most popular open-source project in the history of humanity."
What sets OpenClaw apart from ChatGPT, Claude or any other AI tool is simple to say: it lives in your messaging apps. You never open a browser tab or learn a new interface. You text your agent on WhatsApp, Telegram, Discord, Signal, Slack or iMessage (the same apps you already use every day) and it handles the rest. Email triage. Calendar scheduling. CRM updates. Web research. File management. Shell commands. Smart home control. Travel booking. All through plain conversation.
And it is completely free.
The software costs nothing. The code is open-source. You can run it on a $5/month VPS. That means almost every dollar a client pays you is margin, which makes this one of the highest-margin service businesses you can start in 2026.
Knowing where OpenClaw came from helps you see why it matters to your future clients, and why the opportunity in front of you is so large.
In November 2025, Peter Steinberger, an Austrian developer best known for his work on iOS PDF frameworks, built a personal AI assistant he called Clawdbot. It was a weekend project: a messaging-first agent that could work with his tools through WhatsApp. He pushed it to GitHub.
It spread almost at once. Developers saw something the larger AI companies had missed. People want AI that works inside the apps they already live in, and they are tired of installing new ones. Clawdbot was the first open-source project to get this right.
In February 2026, Peter Steinberger joined OpenAI. He left OpenClaw behind, and governance passed to the newly formed OpenClaw Foundation, backed by several companies and hundreds of individual contributors. That move settled OpenClaw's independence: no single company's ecosystem would ever own it.
In March 2026, Tencent integrated OpenClaw with WeChat, putting the project in front of over a billion users in China overnight. Jensen Huang's GTC shoutout came the same month. The result: 247K+ GitHub stars and growing by thousands a day.
Why does any of this matter to you? Because OpenClaw has crossed from developer tool into mainstream awareness. Your future clients (business owners, executives, real estate agents and agency founders) are starting to hear about it. They want it. They have no idea how to set it up, configure it properly or keep it running. That gap is where you come in.
Before you can sell OpenClaw services, you need to understand how it fits together. Here is the plain-English version.
OpenClaw has no web dashboard or desktop app of its own (community projects exist). Its main interface is messaging platforms. You connect OpenClaw to WhatsApp, Telegram, Discord, Signal, Slack or iMessage, and then you talk to it the way you would text a person.
Say you text your agent on WhatsApp: "Check my email for anything urgent from clients, summarize the top 3, and draft responses. Also move my 2pm meeting to 3pm and let Sarah know."
The agent reads your email through the Gmail API, picks out the urgent messages, summarizes them, drafts replies for your approval, opens your Google Calendar, moves the meeting and sends Sarah a message: all from one WhatsApp conversation.
That is what makes OpenClaw stick with your clients. They never have to learn a new tool. They just text. Think of the busiest person you know: which app do they reply to fastest? That is the app their agent should live in.
OpenClaw leaves the choice of AI model to you. It works with:
That flexibility is something you can sell. Clients watching costs can use Ollama with zero API fees. Clients who care most about privacy keep everything local. Clients who want the best performance can use Claude or GPT-5. Your job is to match the model to each client's needs and budget.
Skills are the building blocks of OpenClaw. Each skill is a self-contained module that gives the agent a new capability:
So the software is free and you can see what it does on a client's behalf. The question that follows is who pays you, and for which part of the work.
This is your bread and butter, the way every client relationship begins. You charge a one-time fee to:
Setup takes you 4-8 hours for a basic deployment and 15-30 hours for enterprise. Even at the low end, you are earning $60-$100/hour.
This is where your recurring income lives, and it is the stream most worth protecting and growing. After setup, your clients need:
Most retainers take 2-5 hours per client per month. At $500/month for 5 hours of work, you are earning $100/hour for maintenance that gets more routine every month.
Here is the part you will come to rely on: clients almost never cancel. Once OpenClaw is running their email, calendar and CRM, removing it would mean going back to doing everything by hand. The switching cost is enormous. Could you handle the 9pm Tuesday breakage for five clients at once while holding down your day job? Be honest with yourself about that before you sign the fifth.
This is the passive income side. Every time you build a custom skill for a client, you can generalize it and publish it on the OpenClaw Skills Marketplace.
The marketplace takes a 15% commission. Top skill publishers earn $2,000-$8,000/month in passive sales. What sells is a skill that solves a specific, painful problem for a niche you can name. "Generic Task Manager" earns nothing. "Dental Office Appointment Reminder and Insurance Verification Bot" earns $300 per sale from every dental practice that finds it.
Each $500 setup for a local estate agent could be a car repair handled or a month of groceries covered once costs are paid, earned over a few evenings of configuration. Two or three of those in a month and $2,000, the bottom figure quoted here, comes into view. Start with whoever in your own contacts is drowning in messages.
You know now where the money comes from. Here is the work a client is buying when they hand over $500-$2K for setup.
This is the exact process for a professional OpenClaw deployment, the work you are charging $500-$2,000 for.
Step 1: Discovery Call (30-60 minutes)
Before you touch any code, understand how your client works. Ask:
- What are the 3 tasks that eat the most of your time every day?
- What messaging app do you live in? (WhatsApp vs Telegram vs Slack matters)
- What tools do you already use? (Gmail, Outlook, HubSpot, Notion, Google Calendar, etc.)
- How many people on your team need agent access?
- What is your privacy sensitivity? (Determines model choice: cloud API vs local Ollama)
- What is your budget for ongoing AI API costs? (Claude/GPT costs $20-$100/month for typical usage; Ollama is free)
Step 2: Infrastructure Setup (1-2 hours)
Deploy OpenClaw on a server the client controls:
| Tier | Cost and setup |
|---|
| Budget option | $5-$10/month VPS on Hetzner, DigitalOcean, or Vultr |
| Standard option | $20-$50/month cloud instance with more RAM for faster responses |
| Enterprise option | Dedicated server or client's existing infrastructure |
Install via Docker (the recommended method): ``` docker pull openclaw/openclaw:latest docker compose up -d ```
Set the LLM backend in the YAML config file. For most clients, Claude (via the Anthropic API) or GPT-4o (via the OpenAI API) gives the best results. For clients watching costs, DeepSeek or local Ollama models handle routine tasks well.
Connect OpenClaw to the client's preferred messaging platform. WhatsApp needs the WhatsApp Business API (a free tier is available). Telegram uses a Bot token (free). Discord uses a bot account. Each platform has its own connector module in OpenClaw.
WhatsApp is by far the most popular choice for non-technical clients, because it is the app they already use for everything.
Step 4: Skill Installation and Configuration (2-4 hours)
Install skills from the marketplace based on what you heard on the discovery call. For a typical business client:
- Email Triage (Gmail or Outlook connector)
- Calendar Manager (Google Calendar or Outlook)
- CRM Connector (HubSpot, Salesforce, or Pipedrive)
- Web Research (general-purpose search and summarize)
- Daily Briefing (morning summary of schedule, priority emails, task reminders)
Each skill needs API keys and configuration, and this is where your expertise earns its keep. You know which permissions to grant, which to hold back, and how to shape each skill around the client's actual workflow.
The system prompt sets the agent's personality, priorities and boundaries. It is the "secret sauce" of a great OpenClaw deployment. A generic prompt gives you a generic agent. A carefully written one gives you an agent that feels like a capable human assistant.
Example for a real estate agent: "You are Alex, a real estate assistant for [Client Name]. Your top priorities: (1) Respond to new lead inquiries within 5 minutes with a warm, professional message. (2) Keep the CRM updated with every interaction. (3) Send daily briefings at 7am with today's showings, pending offers, and follow-up reminders. Never discuss pricing without [Client Name]'s explicit approval. Always be warm and conversational, never robotic."
If you wrote that prompt for your own job today, which line would say what the agent must never do without asking you? Writing that line well is most of the skill.
Step 6: Testing and Handoff (1-2 hours)
Run through every workflow you configured with the client watching. Send test emails, create test calendar events, add test CRM entries. Check that the agent handles odd cases gracefully. Then hand over a simple one-page "How to Use Your Agent" guide: a quick reference card of which commands work and what to expect, short enough to keep beside the phone.
What to Charge
Price an OpenClaw service on the outcome. A real estate agent whose OpenClaw agent answers leads in 5 minutes instead of 5 hours is paying you for the deals they stop losing, and your 8 hours of setup are a small part of that.
| Service | Price Range | Value Proposition |
|---|
| Basic Setup (1 user, 3-5 skills) | $500-$800 | "Your AI assistant, ready in 48 hours" |
| Business Setup (team, CRM, custom) | $1,000-$2,000 | "Automate your entire admin workflow" |
| Enterprise Setup (multi-dept, security) | $2,000-$5,000 | "AI operations across your organization" |
| Monthly Management (basic) | $500/month | "We keep your agent running and improving" |
| Monthly Management (business) | $1,000-$1,500/month | "Dedicated agent optimization and support" |
| Monthly Management (enterprise) | $2,000-$5,000/month | "SLA-backed agent operations" |
| Custom Skill Development | $200-$1,000 | "We build exactly what you need" |
| Marketplace Skills | $50-$500 | Passive income from community sales |
Do not charge hourly. Package your services. Clients hate unpredictable bills, and hourly billing rewards you for working slowly. Flat-rate packages with clear deliverables are easier for you to sell and more profitable to deliver.
Three or four small businesses on a flat monthly management fee give your household a number it can plan around. The money left after support costs could be the school uniform and the weekend football fees, earned keeping a dental practice's reminder agent healthy. Write your first package with one clear price and one clear list of deliverables.
Think about what a retainer does to the rest of your month. You stop refreshing your banking app on the way to work. You stop pretending you forgot your wallet when the group dinner bill arrives. One flat fee from a client who trusts you is the kind of steady income that lets a household breathe.
Security: Be Honest About the Risks
That is the build and the price settled. What follows is the conversation to have with a client before they sign.
This section matters because it is what separates you, a professional OpenClaw consultant, from the amateurs. Anyone can install OpenClaw. Far fewer people understand what it can expose.
The Cisco Talos Findings
In February 2026, Cisco's Talos threat intelligence team published a detailed report on OpenClaw security risks. The key findings:
- Data exfiltration via malicious skills: A skill can be designed to silently read sensitive data (emails, files, credentials) and send it to an external server. The OpenClaw permissions model mitigates this, but only if configured correctly.
- Broad default permissions: Out of the box, OpenClaw grants skills wide access to the filesystem, network, and connected APIs. Most users never restrict these defaults.
- Prompt injection attacks: A carefully crafted email or message could manipulate the agent into executing unintended actions.
- Supply chain risk: Skills from the marketplace are community-contributed. The marketplace has a review process, and it is less rigorous than an enterprise app store's.
Picture your first client's inbox. If one cleverly worded email could make their agent forward a contract to a stranger, would you know how to stop it? The playbook below is how you answer yes.
China's Ban
In March 2026, China's Ministry of State Security banned OpenClaw from all government agencies and state-owned enterprises, citing national security concerns about data sovereignty and how hard it is to audit open-source agent behaviour. The ban made international headlines and raised awareness of agent security risks.
Your Security Playbook for Clients
Turn these risks into a reason to hire you. What you sell is a secure deployment of OpenClaw:
- Self-host on client infrastructure: Data never leaves their network. This is OpenClaw's biggest advantage over cloud-based agent platforms.
- Principle of least privilege: Give each skill only the minimum permissions it needs. The email triage skill gets read access to the inbox and no write access to the sent folder. The calendar skill gets read/write on the calendar and no access to contacts.
- Sandbox deployment: Run OpenClaw in a Docker container with restricted filesystem access. Mount only the directories the agent needs.
- Audit logging: Turn on comprehensive logging so every action the agent takes is recorded and can be reviewed.
- Vetted skills only: Only install marketplace skills from verified publishers with open source code you can audit. For enterprise clients, build custom skills instead of relying on third-party code.
- Regular updates: The OpenClaw Foundation publishes security patches frequently. Keeping instances updated is part of your management retainer.
Being upfront about the risks builds trust with clients. They see you as the expert who knows the risks and knows how to reduce them.
Best Niches for Your OpenClaw Service
Some clients are far better for you than others. The best niches share three things: they are drowning in repetitive admin, they earn enough that $500-$2K/month is easily justified by the time saved, and they are not technical enough to set up OpenClaw themselves.
Solopreneurs and Small Business Owners
This is the sweet spot. A solopreneur spending 2-3 hours a day on email, scheduling and CRM updates is effectively losing $50,000-$100,000/year in productive time. An OpenClaw agent that gives back even half of that pays for itself immediately. Common automations: email triage, meeting scheduling, invoice follow-ups, social media posting and replies to customer questions.
Real Estate Agents
Real estate runs on speed. A lead that gets a reply in 5 minutes is 21x more likely to convert than one that waits 30 minutes. OpenClaw can watch lead sources (Zillow, Realtor.com, website forms), reply instantly over WhatsApp or text, ask basic qualifying questions, book showings on the agent's calendar and update the CRM. All without the realtor lifting a finger. This is a $1,000-$1,500/month easy sell. Do you know a single agent who answers every new lead inside 5 minutes? Most do not, and that gap is your pitch.
Marketing and Creative Agencies
Agencies juggle dozens of client accounts, each with different tools, logins and workflows. OpenClaw can automate cross-client reporting, schedule social posts, watch for brand mentions, sort client emails by urgency and write weekly status updates. The agency owner saves 10-15 hours/week across the team. This is your enterprise tier: $2,000-$5,000 setup, $2,000+/month management.
Executives and High-Net-Worth Individuals
Executives who currently pay $4,000-$8,000/month for a human executive assistant are a natural fit. OpenClaw handles 60-80% of what a junior EA does (email management, scheduling, travel research, meeting prep, expense categorization) at a fraction of the cost. For this audience, call it an "AI chief of staff". The word "chatbot" undersells it to them.
Growing Your OpenClaw Business
One client you can run off your own laptop and your own attention. Several at once changes what has to be in place before you say yes to the next one.
Phase 1: Solo Operator (Months 1-3)
Do everything yourself. Set up 5-10 clients. Learn which workflows matter most, which niches sell most easily and which problems keep coming back. Your revenue target: $5,000-$10,000/month.
Phase 2: Hire Support (Months 3-6)
Your first hire should be a virtual assistant ($500-$1,000/month in the Philippines or Latin America) who handles routine client monitoring, basic troubleshooting and first-response support. You focus on sales, setup and skill development. Revenue target: $10,000-$15,000/month.
Phase 3: Productize (Months 6-12)
Create standard setup packages by niche. "OpenClaw for Real Estate" comes with pre-configured skills, system prompts and onboarding materials, so you can deploy it in 2 hours instead of 8. Build a library of niche skills on the marketplace for passive income. Hire a second VA or a part-time developer. Revenue target: $15,000-$20,000/month.
Phase 4: Agency (Year 2+)
By now you run an AI operations agency. Several team members handle setup and support. You sell to larger clients. You have a portfolio of marketplace skills bringing in $3,000-$8,000/month in passive revenue. You might white-label your service for other agencies. Revenue target: $30,000-$50,000+/month. Which phase would you be happy to stop at? Plenty of people stay at Phase 2 on purpose, because it keeps the work in their own hands.
Once a dental practice tells another owner that your agent saved them hours a week, referrals start arriving on their own. People who doubted a messaging bot could be a business begin asking over dinner how you found clients, and you have a real story to tell them. Ask every happy client for one introduction while the result is fresh.
| Feature | OpenClaw | ChatGPT (OpenAI) | Claude (Anthropic) | Custom Agent (LangChain) |
|---|
| Cost | Free (open-source) | $20-$200/month | $20-$200/month | Free framework + dev time |
| Self-hosted | Yes | No | No | Yes |
| Model-agnostic | Yes (any LLM) | GPT only | Claude only | Yes |
| Messaging-first | Yes (WhatsApp, Telegram, etc.) | Web/app only | Web/app only | Requires custom build |
| Skills marketplace | Yes (hundreds of skills) | GPT Store (limited agents) | No | No |
| Setup difficulty | Medium (Docker + config) | Easy (just sign up) | Easy (just sign up) | Hard (requires coding) |
| Privacy | Full control (your server) | Data on OpenAI servers | Data on Anthropic servers | Full control |
| Best for | Power users, businesses, custom workflows | General consumers | Writing, analysis, coding | Developers building custom products |
OpenClaw wins on three counts: it is free, it is built for messaging, and it is fully self-hosted. It loses on ease of setup (which is exactly why your service business exists) and on polish (there is no sleek web UI like ChatGPT's).
The Tencent-WeChat Integration and Global Expansion
In March 2026, Tencent announced official OpenClaw integration with WeChat, the messaging platform used by 1.3 billion people in China and across Asia. That matters to you for two reasons:
- Validation: The world's largest messaging company chose OpenClaw over building its own agent framework. That signals OpenClaw is becoming the default standard for messaging-based AI agents.
- Market expansion: If you serve clients in Asia-Pacific markets, WeChat integration opens a huge new deployment option. Businesses that run on WeChat can now have OpenClaw agents handling their customer conversations, order processing and internal workflows.
The Tencent deal also means OpenClaw is likely to grow even faster through 2026-2027, and that means more demand for your setup and management work.
Getting Started Today
This opportunity has a clock on it. Right now, demand for setup services far exceeds supply. Most businesses have heard of OpenClaw and have no idea how to deploy it. Within 12-18 months, managed OpenClaw hosting platforms will appear (some are already in beta) and turn basic setup into a commodity.
Your window to become known as an OpenClaw expert, build a client base on recurring retainers and create marketplace skills that keep earning is right now. Your startup cost is close to zero. You need a computer, an internet connection and a willingness to learn a new platform over a weekend. If managed hosting takes the basic setups in 12-18 months, what will your clients still need you for? Build toward that answer from the first client.
Install OpenClaw today. Use it yourself for a week. Then start selling.
Related: AI Automation Agency | Vibe Coding Side Hustle | Best AI Side Hustles 2026
While you mull it over, someone in your area is setting up their first paid agent and asking that client for a referral. The skills you need are a weekend away. The clients are the scarce part, and they go to whoever turns up first with a working demo. Install it tonight, and by next weekend you could have something real to show a business owner you already know.
2026 Market Snapshot
OpenClaw sits at the centre of three independent market research reports: OpenClaw Hosting (the wrapper-bubble economics), Agent-First Companies (where it fits in the broader stack) and Agentic Payments (how those agents will transact). An independent OpenClaw Hosting market report is unambiguous: OpenClaw hit 200,000 GitHub stars in 84 days, and self-hosting demands Docker, API key management, reverse-proxy setup and security hardening. Each of those friction points is a paid opportunity for you. The wrapper window is short, closer to 90 days than 90 months, while the security and integration layer survives the way WP Engine did for WordPress.
- 200,000 GitHub stars on OpenClaw within 84 days of public launch
- 42,000 exposed OpenClaw instances scanned online; 93.4% vulnerable to known exploits
- 10 wrapper SaaS platforms hit $20,000+ MRR in days during the early launch window
- The AEO market is projected to reach $7.3B by 2031 from $886M today (34% annual growth)
- 40% of agentic AI projects will be cancelled per Deloitte; 60% remain. The survivors are vertical specialists
Key Players to Watch
The leverage is split between core maintainers, hosting platforms and the payment infrastructure being built around them.
| Player | Role |
|---|
| Peter Steinberger | Created OpenClaw, joined OpenAI in Feb 2026, sets the roadmap |
| OpenClaw Foundation Contributors | Core maintainer team running the project post-Steinberger |
| Clawctl | Security-first managed hosting with sandboxed execution |
| ClawPod | 5-minute setup, instant kill switches |
| MyClaw.ai | Affordable fully-managed dedicated instances |
| OpenClaw Cloud | Free model credits, custom URLs included |
| LaunchClaw | Telegram and WhatsApp managed deployments |
| Skyfire and Payman AI | Agent-specific payment rails for OpenClaw skill marketplaces |
| Coinbase x402 | Micropayment protocol for agent-to-agent API commerce |
| Stripe Agentic Commerce, Visa Intelligent Commerce, Mastercard Agent Pay | Card-network rails for agent purchases |
| ERC-8004 | Emerging Know Your Agent identity standard |
| Tencent / WeChat | Brought OpenClaw to 1.3B users via official integration in March 2026 |
Predictions for 2026-2027
- Q3 2026: Curated agent skill marketplaces ship in beta with code signing and sandboxed previews. The App Store moment for AI agents
- Late 2026: AEO (agent experience optimization) becomes a paid service category alongside SEO
- 2026: First wave of OpenClaw hosting providers gets acquired or shut down as OpenAI ships first-party deployment
- Mid-2027: Stripe and Visa control 70% of agent-to-merchant commerce while x402 dominates agent-to-agent micropayments
- 2027: Know Your Agent (KYA) becomes a regulated requirement under EU AI Act timelines, creating a verification-as-a-service category
Read that list again and notice how much of it lands this year and next. Each change rewards whoever is already running agents for paying clients by the time it lands. Hosting giants can automate an install. They cannot automate the trust a dentist feels for the person who fixed her reminders at nine on a Friday night.
Emerging Opportunities
Security auditing for OpenClaw deployments. With 93.4% of public instances vulnerable, a productized audit service ($500-$2,500 per engagement) covering Docker hardening, API key rotation, prompt-injection defences and rate limiting is a revenue line you could open right away. Most clients have no in-house security team to do this themselves.
Curated skill marketplace. The Apple App Store model. Curate, code-sign and sell access to a shelf of OpenClaw skills with a 10-30% revenue share. Pair it with x402 micropayment rails so skills can charge per call instead of per month.
Agent observability platform. An independent OpenClaw Hosting market report literally describes this opportunity as "the Datadog for AI agents." Track API costs, model routing, error rates and latency across a client's agent stack and bill $99-$499 per agent per month.
Cost-optimization SaaS. Build a proxy layer that caches LLM responses, sends prompts to cheaper models when accuracy allows, and enforces hard billing caps. Clients running several OpenClaw agents are bleeding money on uncached API calls.
Common Objections & Counterarguments
"This is just another wrapper bubble that will pop." That holds for commodity hosts, and much less so for security and observability layers. The independent market research report draws the WordPress / WP Engine comparison directly. WordPress turned 20 and managed WordPress hosting still supports billion-dollar businesses. Build on the durable layer of the wrapper.
"OpenAI will eat this when they ship first-party deployment." Likely for basic hosting. Less likely for vertical compliance, KYA and security tooling, where platform owners have historically underinvested. Build where Big Tech does not want to live.
"Self-hosting will get easy enough that nobody pays for managed." WordPress is 20 years old, its setup is trivial next to OpenClaw's, and managed WordPress hosting is still a multi-billion-dollar market. Friction never fully disappears in production deployments.
"AI agents are overhyped. Deloitte says 40% get cancelled." Read the same number again: 60% of agentic projects continue, and consumer adoption keeps growing on its own. Pick clients who already have an internal champion and a budget. Those are the 60% that survive.
The security section above covers the software's risks. This one covers yours. Once you install and configure an agent for a paying client, you carry obligations that a hobbyist running the same software at home never does.
You will be holding credentials, and that is a service in itself
Setting up an agent for a client means being handed access: mailbox credentials, API keys, calendar and file storage, sometimes a CRM or a payment processor. You cannot do the job without it.
Treat that custody as a named part of your work, and give it the same care as the build.
Never accept credentials over chat or email. Use the client's password manager or a secrets tool with expiring shares. A key pasted into a message thread lives in two mailboxes and every backup of both, permanently.
Ask for scoped credentials, and expect to explain why. An agent that reads a shared mailbox has no need for administrative access to the whole tenant. Most clients will grant whatever is easiest unless you say otherwise, and that broad grant becomes your problem when something goes wrong.
Keep a written inventory of what you were given, when and what for, and confirm in writing when access is revoked at the end of the engagement. Access that lingers after a relationship ends is a liability with no upside.
Never hold production credentials in your own tooling once the engagement ends. Configure in the client's environment, in the client's accounts, and hand over ownership.
How many passwords from past clients are still sitting in your own notes or chat history right now? If the answer is more than none, clean that up before you take on an agent client.
Data protection applies to you, and it probably names you
If your client has users or staff in the EU or UK, the agent you configured is processing personal data, and the law defines the roles whatever your invoice says. The client is generally the controller. You, processing that data on their instructions, are generally a processor, and the relationship has to be governed by a written contract with specified terms.
Here is what that means for a small consultancy like yours.
You need a data processing agreement in place before the agent touches real data. Most clients of any size will have a template; if yours does not, that gap is itself worth flagging to them.
You need to know where data goes. An agent that sends message content to a model provider is passing it to a subprocessor, and the client is entitled to know which providers are involved and where they operate.
You need to be able to describe what the agent keeps. Logs, conversation history and cached content all count as personal data if they contain it, and "I did not think about the logs" is a poor answer to give when someone asks.
Comparable duties exist in other regimes. Several countries now impose specific obligations where automated systems handle personal or financial data, and the direction is consistently toward more documentation rather than less.
Contract terms that match the actual risk
An agent acts on its own. That is the whole value you are selling, and it is also why the engagement needs terms that a website build never would.
Define what the agent may do unattended, in writing, agreed with the client. Sending external email, making purchases, deleting anything and touching customer records each deserve an explicit line. This document protects you both, and the client will find it useful for running their business regardless of liability.
Cap your liability at the engagement fee. You cannot carry uncapped exposure for a system that can send messages as your client to your client's customers.
State plainly that the configuration cannot guarantee protection against prompt injection or malicious skills. These are live, unsolved categories of attack, as the Cisco findings above make clear. A client who understands that from the start will accept a hardened configuration as risk reduction and will never read it as a promise.
Agree who monitors it after handover. An agent left running unattended for six months after you walked away will eventually do something surprising, and without an agreement the person who set it up gets the call.
Carry professional indemnity cover, and check the exclusions. Policies written for general IT consultancy often exclude AI systems, automated decision-making or work touching financial infrastructure. A policy that excludes the thing you do gives you no cover at all.
None of this is a reason to avoid the work. It is what separates a consultancy from a favour with an invoice attached, and clients paying professional rates increasingly expect to see it.