The version of this you are actually facing
You have a scope of work, two firms that both say they can do it, and proposals that read almost the same. Both name the right technologies. Both attach résumés that clear the bar. The price gap is not large enough to decide on. What the proposals do not show is that the two firms run different businesses, and only one of them is structurally in the business of finishing anything. The difference surfaces around month six, when you ask where the repository lives, or what happens if the lead engineer leaves.
The stakes rise when the work is headed somewhere regulated: an environment with an impact level, a boundary that has to be documented, controlled data that has to stay inside it. There the deliverable is never only software. It is software plus the evidence that the software behaves the way the documentation claims. Evidence is an artifact. Artifacts have owners. Who ends up owning them is the cleanest single test of which kind of firm is across the table.
Two business models wearing the same clothes
A staffing firm — the honest kind, which is most of them — makes money on utilization. Revenue is headcount multiplied by rate multiplied by billable hours, and everything the business optimizes follows from that identity. It recruits to match labor-category descriptions rather than your architecture. It keeps people on seats. It has no structural reason to make the work require fewer hours, because fewer hours is less revenue. That is not a moral defect. It is what the model rewards.
A delivery firm makes money when a defined outcome is accepted. Revenue is tied to a thing existing and working. That identity rewards the opposite behaviors: writing acceptance criteria down before starting, automating whatever repeats, and producing artifacts that make the next change cheaper rather than more expensive. It also carries real risk, which is why delivery firms are pickier about scope and will sometimes tell you the scope is not ready.
Both are legitimate purchases. Staff augmentation is the right buy when you already hold the architecture, you have design authority and review capacity in house, you know your retention plan, and you are simply short of hands. The failure is not buying staff augmentation. The failure is buying staff augmentation while believing you bought a system, and finding out at the moment you needed the system to exist without its authors.
The federal vocabulary already contains this distinction
Federal contracting has spent decades writing this difference down, and the language is public, which makes it useful even to a commercial buyer who will never sign a government contract. Start with the contract type that describes the staffing model exactly. FAR 16.207-1 defines a firm-fixed-price, level-of-effort term contract as one that "requires the contractor to provide a specified level of effort, over a stated period of time, on work that can be stated only in general terms." FAR 16.207-2 then says the quiet part in regulation: "payment is based on the effort expended rather than on the results achieved."
Read that as a description, not an accusation. The FAR places it under work suitable for "investigation or study in a specific research and development area" — where the task genuinely cannot be specified in advance. It is a tool for a real problem. It becomes a problem only when it is applied to work that could have been specified and was not, because leaving it vague is more profitable for one side.
FAR 37.602, on how to write a performance work statement
Agencies are directed to "describe the work in terms of the required results rather than either 'how' the work is to be accomplished or the number of hours to be provided." FAR 37.601 adds that a performance-based service contract shall include a performance work statement, measurable performance standards "in terms of quality, timeliness, quantity, etc." and the method of assessing contractor performance.
A third piece of vocabulary is worth borrowing. FAR 37.101 defines a nonpersonal services contract as one under which "the personnel rendering the services are not subject, either by the contract's terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees." FAR 37.104(a) describes a personal services contract as one "characterized by the employer-employee relationship it creates between the Government and the contractor's personnel," and 37.104(b) states that agencies "shall not award personal services contracts unless specifically authorized by statute." The descriptive elements at 37.104(d) include work performed on site, principal tools furnished by the Government, and services whose inherent nature requires Government direction or supervision.
A commercial buyer is bound by none of that, and the test still travels. If your own managers would direct the vendor's engineers the way they direct your employees — assigning the day's work, reviewing it, deciding what comes next — you are buying labor. That can be exactly what you want. It should not be a discovery.
Why "who owns the artifacts" is the sharp question
Both models produce code, and the code can be good in both. The difference is what exists at the end that is not a person. A delivery engagement leaves behind things that keep working after everyone has moved on: a repository with real commit history, infrastructure as code that rebuilds the environment from empty, a pipeline definition including its policy checks, an evaluation harness with a baseline someone else can rerun, a runbook written for the day the system misbehaves, decision records explaining the expensive choices, and control narratives written by the people who built the controls.
A staffing engagement can leave behind an environment that runs beautifully and is nonetheless unrecoverable, because the knowledge required to rebuild it lives in the heads of contractors whose contract just ended. Nothing was hidden. It simply was never externalized, because externalizing it was not what anyone was paid for.
This is why we treat platform artifacts as the deliverable rather than as documentation about the deliverable. In our platform engineering work the output is the golden paths themselves, the Terraform modules, the pipeline and its policy engine configuration, the hardened images and registry governance, the secrets and PKI patterns, and the controls-inheritance document mapping each path to the NIST SP 800-53 control families the platform satisfies for the teams on it. Those are objects an organization keeps. A team embedded for a year that produced none of them has not produced a platform. It has produced a dependency.
Six questions, and what the two answers sound like
Ask these in a working session rather than in a written questionnaire. The written answers will be identical; the spoken ones will not be.
| What you ask | Sounds like a delivery engagement | Sounds like a staffing arrangement |
|---|---|---|
| How would you price this? | A written scope, a named deliverable list, acceptance criteria, and a fixed amount for a first increment. | A rate card by labor category and an estimate expressed in full-time-equivalent months. |
| What is actually on the deliverable list? | Named objects: repository, infrastructure code, pipeline, evaluation harness with a baseline, runbook, control narratives. | Status reports, sprint demonstrations, and a monthly summary of hours consumed. |
| Where does the repository live on day one? | In your organization, from the first commit, with your people holding admin. | In theirs, with a transfer promised at the end of the engagement. |
| Name an acceptance criterion you could fail. | A specific, measurable one, offered without hesitation, sometimes narrower than you expected. | Satisfaction, responsiveness, velocity, or burndown against a plan they will also be writing. |
| What happens when the named engineer leaves? | Here is the handover artifact set, and here is the onboarding time it implies for a replacement. | We will propose a substitute résumé at the same labor category and rate. |
| Will you do a small fixed-scope first increment? | Yes, and here is the shape of one that would be worth doing. | We would start with a time-and-materials discovery phase and revisit. |
A firm can give a right-hand answer for an entirely good reason. If your scope really is undefined, an honest firm will say so and refuse to price a fixed increment against fog — the situation FAR 16.207-2 was written for. The table is not a trap. Its job is to make sure the answer you receive matches the thing you believe you are buying, and to surface the mismatch before signature.
Put the artifact list in the contract, not in the kickoff deck
Every artifact below is boring, and every one of them is what you will wish you had specified. Naming them in the agreement costs one paragraph and changes the incentive structure of the entire engagement.
- Source repository inside your organization from the first day of work, with full commit history — not a bundle delivered at the end
- Infrastructure as code that rebuilds the environment from empty, exercised at least once by someone who did not write it
- Pipeline definition, including policy and security checks, versioned in the same repository as the code it builds
- Evaluation harness with a recorded baseline, runnable by your staff on your hardware without the vendor present
- Runbook written for failure modes, on-call handoff, and rollback — not a happy-path installation guide
- Architecture decision records for the choices that were expensive or hard to reverse
- Control narratives and boundary documentation written by whoever implemented the control
- A named exit: what is handed over, in what format, and the test that proves it landed
DoD formalizes this, and the form is worth copying even if you are a commercial buyer. DD Form 1423, the Contract Data Requirements List, enumerates each data deliverable, its format, and when it is due, and each entry is a contractual obligation rather than an aspiration. You do not need the form. You need the habit it encodes: data deliverables get listed, not assumed.
If the work will ever be delivered under a DoD contract, ownership stops being a preference and becomes a licensing question with published defaults. DFARS 252.227-7014, "Rights in Other Than Commercial Computer Software and Other Than Commercial Computer Software Documentation," lays out unlimited rights, government purpose rights, restricted rights, and specifically negotiated license rights. Government purpose rights run five years by default, measured from execution of the contract, subcontract, modification, or option that required development of the software, after which the Government's rights become unlimited. SBIR and STTR work is handled separately by DFARS 252.227-7018, covered in our piece on SBIR data rights. A vendor who has never had to assert a restriction under one of these clauses is not disqualified by that — but how they answer tells you whether they have thought about who owns what, or whether it never came up because they only ever supplied hours.
What the rules force once federal money enters the chain
If you are a small business acting as prime on a set-aside, the arrangement where a subcontractor quietly performs everything is not merely a quality risk. It is an eligibility problem, and the regulations are specific about it.
Limitations on subcontracting. Under 13 CFR 125.6, for a contract for services other than construction, the prime agrees that "it will not pay more than 50% of the amount paid by the government to it to firms that are not similarly situated." Work further subcontracted by a similarly situated entity counts toward the same limit. Arithmetic, not judgment.
The ostensible subcontractor rule. Under 13 CFR 121.103(h)(3)(i), an ostensible subcontractor is one that is not a similarly situated entity and "performs primary and vital requirements of a contract, or of an order, or is a subcontractor upon which the prime contractor is unusually reliant," and an offeror is ineligible as a small business concern where SBA determines there to be one. Renting the technical core of a program is exactly the fact pattern this addresses.
SBIR and STTR performance of work. The SBA SBIR/STTR Policy Directive puts a floor under how much of the work the awardee itself has to do, and the two programs set that floor differently. Under SBIR, the awardee performs a minimum of two-thirds of the research or analytical effort in Phase I and a minimum of one-half in Phase II. Under STTR, not less than 40 percent of the work is performed by the small business and not less than 30 percent by the partnering research institution, in both phases. A staffing relationship that supplies the people who do the science is difficult to reconcile with either floor.
Controlled data flows down with the work. DFARS 252.204-7012 obligates a contractor handling covered defense information to include the substance of that clause in subcontracts where the subcontractor will handle the same information. Under the CMMC program rule at 32 CFR 170.23, a subcontractor that will only process, store, or transmit FCI needs a CMMC Status of Level 1 (Self); one handling CUI needs Level 2 (Self) at minimum, rising to Level 2 (C3PAO) where the prime contract requires Level 2 (C3PAO) or Level 3 (DIBCAC). If the arrangement is "we will just add their people to our environment," those people are inside your assessment boundary, and so is their laptop fleet. Our piece on CUI arriving in your product works through that.
None of these rules cares what a firm calls itself. They care about who performs the work and who holds the data. That is the same question as who owns the artifacts, asked by a regulator instead of by you.
Where the line legitimately blurs
We genuinely need hands, not a system
Then buy staff augmentation deliberately and write the retention plan first. Decide who holds design authority, who reviews the code, and what happens to the knowledge when the engagement ends. Staff augmentation bought on purpose, with an artifact requirement attached, works fine. It is the accidental version that fails.
Fixed price against vague scope is how projects go bad
True, and this is the strongest argument for the level-of-effort model. The answer is not a large fixed-price bet on fog. It is a small fixed-scope increment whose only purpose is to make the scope knowable — a spike, a boundary diagram, a working slice through the hardest interface — after which both parties can price the rest with information instead of optimism.
Good firms bill hourly too
They do, and contract type is weaker evidence than the deliverable list. A time-and-materials arrangement with named artifacts, acceptance criteria and a repository you own is a delivery engagement. A firm-fixed-price arrangement whose only deliverable is a monthly status report is not. Read the deliverables clause, not the pricing clause.
Our security team will not let a vendor hold the repository
Good. That constraint pushes you toward the delivery answer anyway. A firm that objects to committing into your organization from day one is telling you something about how it plans to maintain leverage, and it is better to hear it during negotiation than during offboarding.
What we do here, and what we will not take
Precision Federal is an Iowa limited liability company and a small engineering firm with a few members. We take scoped work with a written deliverable list and acceptance criteria we can fail, and we build the artifacts described above because they are the product, not a byproduct of it.
We do not sell staff augmentation. We will not place engineers under your program manager to work a backlog we do not own, and we do not price engagements as a team of N for M months against a labor-category rate card. If the scope cannot be written down well enough to say what gets delivered and how you would reject it, we say so, and offer a short fixed-scope increment whose purpose is to make it writable. The standing refusals beyond that: we do not issue ATOs, because the authorization is a federal official's risk decision. We are not a C3PAO and cannot assess you for CMMC. We do not perform your independent assessment and then remediate our own findings. We hold no facility clearance today and do not perform classified work on classified networks. We are not a training vendor, and we do not write proposals for other firms. We will not claim a component arrives pre-accredited, because nothing does. The longer list is on its own page.
An engagement starts with the constraint, not the capability deck. Send the shape of the problem — impact level, boundary, where the data has to stay, what the deadline is attached to — and the response is a written scope, a deliverable list, acceptance criteria, and a fixed amount for a first increment. The repository sits in your organization from the first commit. If another firm is the better fit, we say that instead, which is cheaper for both of us than finding out in month six.
Frequently asked questions
A subcontractor is accountable for a defined outcome and is paid when that outcome is accepted. A staffing arrangement supplies labor and is paid for hours consumed. FAR 16.207-2 describes the second model directly: payment "based on the effort expended rather than on the results achieved." Both can be legitimate purchases; the problem is buying one while expecting the other.
"Name an acceptance criterion you could fail." A delivery firm answers with something specific and measurable, sometimes narrower than you expected. A staffing firm answers with satisfaction, responsiveness, or velocity — none of which can be failed in a way that costs them money.
The repository in your organization from day one, infrastructure as code that rebuilds the environment from empty, the pipeline definition with its policy checks, an evaluation harness with a recorded baseline, a failure-mode runbook, architecture decision records, control narratives, and a defined exit test. DoD lists data deliverables on DD Form 1423, the Contract Data Requirements List; commercial buyers can copy the habit without the form.
Because the deliverable includes evidence, and evidence has to be reproducible by people other than its authors. Boundary documentation, control narratives, and a rebuildable environment are what an assessor examines. If those exist only as tacit knowledge in a contractor's head, the assessment cannot proceed once the contractor leaves.
Yes, where federal money is involved. 13 CFR 125.6 limits a services prime on a set-aside to paying no more than 50% of the government's payment to firms that are not similarly situated. 13 CFR 121.103(h)(3) makes an offeror ineligible as a small business where SBA finds an ostensible subcontractor performing primary and vital requirements. Under the SBA SBIR/STTR Policy Directive, an SBIR awardee performs at least two-thirds of the effort in Phase I and at least one-half in Phase II; under STTR the small business performs not less than 40 percent and the partnering research institution not less than 30 percent.