[Bug] "Need admin approval" when consenting to write scopes (Mail.Send, Calendars.ReadWrite) in tenant

Environment

• OS: Windows (win_x64)
• WorkIQ version: workiq-preview v0.5.0
• Tenant: Microsoft corporate tenant (user self-consent blocked by policy)
• Account: @microsoft.com

Problem

Running workiq auth consent --scopes Mail.Send Mail.ReadWrite Calendars.ReadWrite triggers a "Need admin approval" dialog:

Work IQ CLI needs permission to access resources in your organization that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

Entity write tools (create_entity_work_iq, do_action_work_iq) return HTTP 403 Forbidden when targeting paths like /me/sendMail or POST /me/messages.

Read operations work fine (fetch_work_iq on /me/messages, /me/events, /me/drive).

Expected Behavior (Question)

The workiq-preview README documents write capabilities (send mail, create events, etc.) and the troubleshooting guide says to run workiq auth consent --scopes <scope> for 403 errors. However, in the Microsoft corporate tenant, user self-consent is blocked by policy.

Is write support expected to work in enterprise tenants that require admin consent? If so, what's the recommended path to enable it — should these scopes be added to the tenant-wide admin consent, or is there another approach?

Reproduction

1. Install workiq-preview: /plugin install workiq-preview@work-iq
2. Try sending an email via do_action_work_iq → /me/sendMail → 403 Forbidden
3. Run npx -y @microsoft/workiq@preview auth consent --scopes Mail.Send → "Need admin approval" blocked

References

• Related: #82, #85
• Troubleshooting doc mentions workiq auth consent as the fix, but it requires admin approval in enterprise tenants

Start with the workiq auth consent command and the troubleshooting guidance referenced in the README, then compare the Mail.Send, Mail.ReadWrite, and Calendars.ReadWrite reproduction steps with related issues #82 and #85. Determine whether the documented write flow covers tenants requiring admin consent and document the supported enablement path or the limitation.