What to actually do

The two parts before this make the same argument from opposite ends: the build is the easy half, and the leverage is real today; the company — accountability, money, the law — is the hard half a human still has to own. What follows turns that into an order of operations.

Tooling, staged

1. Start with the build layer you can control. If you’re shipping a product, adopt a gstack-style skill/sprint discipline on Claude Code, Codex or Cursor first. It delivers real solo leverage at low risk, and it’s the most mature layer by a wide margin.
2. Add an orchestration/governance layer only when you genuinely run many agents. paperclip — or CrewAI/LangGraph if you want to build custom — earns its keep at ~20 agents, not at one. Keep chains short (≤~4 coordinating agents) and insert an independent validation or “judge” step. That, not a bigger model, is what moves reliability.
3. Keep a human gate on anything irreversible — payments, contracts, public communications, data deletion, customer promises. Budget hard-stops and immutable audit logs (paperclip provides both) are table stakes, not nice-to-haves.
4. Treat function automation as augmentation. Lindy, n8n, Make and Zapier are broad but shallow on autonomy; measure per-step error rates on real inputs before widening it.

1. Harden security from day one — least-privilege tool access, vet third-party “skills,” isolate secrets. Agent autonomy widens the attack surface, and the “lethal trifecta” (data access + untrusted content + external communication) is unsolved.

Legal & tax, staged

1. Book a Steuerberater consultation before founding — to confirm whether any consulting you keep is still freiberuflich, and to classify the agentic-AI product business (almost certainly gewerblich).
2. Default to a domestic GmbH (or a UG if capital is tight) for limited liability on a product business. Keep any freiberufliche consulting strictly separated — separate invoicing, bookkeeping and accounts — to manage Abfärbe risk.
3. Do not incorporate abroad to save tax while living in Hamburg. If international structuring is genuinely needed — real US or EU operations with substance — get specialist cross-border advice on Betriebsstätte, place-of-effective-management and Hinzurechnungsbesteuerung first.
4. Build EU AI Act + GDPR compliance in early — records of processing, DPIAs, transparency and content labeling, human oversight — since high-risk and transparency duties bite through 2026.