WorkIQ CLI returns 403 Forbidden / caller not entitled despite successful tenant enablement and licensing

Summary

WorkIQ is not usable in our tenant even after full admin enablement and user re-authentication.
workiq ask consistently returns 403 (Forbidden), and workiq fetch -u /me returns The caller is not entitled to use this tool.

CLI version

workiq version → 1.0.0.28144

Repro steps

1. Run tenant provisioning/verification scripts:
   • pwsh -NoProfile -File scripts/Enable-WorkIQToolsForTenant.ps1
   • pwsh -NoProfile -File scripts/Verify-WorkIQTenant.ps1
2. Ensure account is logged in:
   • workiq auth logout
   • workiq auth login --account <user>
   • workiq auth consent -s "Mail.Read Sites.Read.All People.Read.All OnlineMeetingTranscript.Read.All Chat.Read ChannelMessage.Read.All ExternalItem.Read.All" --account <user>
3. Run:
   • workiq ask --json -q "did Kearns send me an email today?"
   • workiq fetch -u /me

Actual behavior

• workiq ask --json ... returns:
  • {"isError":true,"error":"Response status code does not indicate success: 403 (Forbidden).",...}
• workiq fetch -u /me returns:
  • The caller is not entitled to use this tool.

Also reproduced across multiple prompts and agent IDs (including bizchat-as-gpt-scenario and planner declarative agent).

Expected behavior

After successful tenant enablement + consent + login, ask and fetch should execute (or return a specific missing-permission diagnostic if something is still missing).

Evidence that setup appears correct

• Verify-WorkIQTenant.ps1 reports all checks passed:
  • required MCP service principals exist
  • Work IQ CLI SP exists
  • required Graph delegated grants present
  • MCP server grants present
• Enable-WorkIQToolsForTenant.ps1 reports permissions already granted.
• User has Microsoft_365_Copilot SKU assigned (service plans reported as provisioned).
• MFA is enabled/enforced for the user:
  • Graph /beta/users/{upn}/authentication/requirements returned perUserMfaState: enforced
• WorkIQ CLI config:
  • default account set correctly
  • reproduces with both experimental=true and experimental=false
• workiq agents list succeeds, but ask/fetch remain blocked.

Suspected issue

A backend entitlement gate mismatch: tenant/app consent and licensing appear valid, but execution endpoints still treat the caller as not entitled.

Start by running scripts/Enable-WorkIQToolsForTenant.ps1 and scripts/Verify-WorkIQTenant.ps1, then reproduce with workiq ask and workiq fetch -u /me using the listed account and consent commands. Compare the successful tenant checks with the 403 and entitlement responses; done means those commands execute after valid enablement or return a specific missing-permission diagnostic.