π "We'll add auth before production" is how plugin projects lose a week. Auth shapes consent, refresh, and user identity. Test the real flow early.

π "We'll add auth before production" is how plugin projects lose a week. Auth shapes consent, refresh, and user identity. Test the real flow early.
π¨ A valid API plugin can still call the wrong endpoint. Copilot routes from descriptions, so write the boundary: "Use for onboarding progress. Don't use for HR policy." Test it like code.
β‘ MCP plugins should not be frozen in yesterday's manifest.
Dynamic tool discovery lets Copilot resolve the current tool surface at runtime.
ποΈ "It worked in dev" is not a release plan.
WIQD separates package, provision, and share so agent promotion has gates, evidence, and a smaller blast radius.
π¨ The eval blank page is where too many agents die.
WIQD turns your manifest into coverage for retrieval, refusals, tool calls, confirmations, and errors.
π₯ Agent scaffolding is easy. Grounding it safely is the work.
Turn a business brief into scope, sources, refusals, citations, and tests.
π A shared file format isn't portability. Import an Agent Plugin into WIQD, export it, then test issue triage in a second client. Skills and MCP intent can travel. Auth can't.
π― Your agent doesn't need every procedure in its main instructions. Custom skills load the playbook when the job calls: focused, reviewable behavior instead of instruction sprawl.
π¨ Don't give PR code a Microsoft 365 identity. Run WIQD static checks offline. Keep validation and evals on trusted main. Same lifecycle. No secrets near untrusted code.
My test for an agent: would anyone miss it if it disappeared tomorrow?
Not "was the demo impressive." Not "did the prompt sound clever."
Would someone say: wait, where did that go? I need it.
π¨ Importing an Agent Builder agent isn't a rewrite. Preserve instructions, starters, and refusals first. WIQD turns the prototype into reviewable files, parity checks, and evals.