Guide
Who owns the domain, the profile and the data
Updated
Everything else in this decision is a matter of degree. Ownership is binary, it is checkable in ten minutes, and getting it wrong quietly costs a contractor everything they have paid for.
The domain
It should be registered to the business, in an account the business controls, with the business's own contact details. An agency holding the domain holds the entire asset.
Check the registrar account yourself. If you cannot log in, you do not own it in any way that matters.
The business profile
Local search for trades runs substantially on the business profile, and the reviews and history attached to it are built over years and cannot be moved.
Owner-level access must stay with the business, with the agency added as a manager. Google's own documentation covers how ownership and access work, and it is worth reading once.
Analytics and Search Console
These are your independent view of the truth. Where the agency owns the property, every report you receive is one they chose to produce from data you cannot reach.
Own the properties and grant access. It costs nothing and it changes the relationship.
The website and its content
Ask what happens to the site and the content if you leave. A site built on an agency's proprietary platform frequently cannot move, which converts a marketing decision into a permanent dependency.
Get the answer in the contract rather than in an email, because it is the term most likely to be tested.