🔐 "We'll add auth before production" is how plugin projects lose a week. Auth shapes consent, refresh, and user identity. Test the real flow early.

🔐 "We'll add auth before production" is how plugin projects lose a week. Auth shapes consent, refresh, and user identity. Test the real flow early.
🚨 A valid API plugin can still call the wrong endpoint. Copilot routes from descriptions, so write the boundary: "Use for onboarding progress. Don't use for HR policy." Test it like code.
⚡ MCP plugins should not be frozen in yesterday's manifest.
Dynamic tool discovery lets Copilot resolve the current tool surface at runtime.
🏗️ "It worked in dev" is not a release plan.
WIQD separates package, provision, and share so agent promotion has gates, evidence, and a smaller blast radius.
🚨 The eval blank page is where too many agents die.
WIQD turns your manifest into coverage for retrieval, refusals, tool calls, confirmations, and errors.
🔥 Agent scaffolding is easy. Grounding it safely is the work.
Turn a business brief into scope, sources, refusals, citations, and tests.
🔄 A shared file format isn't portability. Import an Agent Plugin into WIQD, export it, then test issue triage in a second client. Skills and MCP intent can travel. Auth can't.
🎯 Your agent doesn't need every procedure in its main instructions. Custom skills load the playbook when the job calls: focused, reviewable behavior instead of instruction sprawl.
🚨 Don't give PR code a Microsoft 365 identity. Run WIQD static checks offline. Keep validation and evals on trusted main. Same lifecycle. No secrets near untrusted code.
My test for an agent: would anyone miss it if it disappeared tomorrow?
Not "was the demo impressive." Not "did the prompt sound clever."
Would someone say: wait, where did that go? I need it.
🚨 Importing an Agent Builder agent isn't a rewrite. Preserve instructions, starters, and refusals first. WIQD turns the prototype into reviewable files, parity checks, and evals.