Update setup instructions: add authMode, OBO+S2S auth, and agentType-based capabilities

docs/agent365-guided-setup/a365-setup-instructions.md

@@ -4,11 +4,11 @@
 
 ---
 
-> **YOUR FIRST AND ONLY ACTION RIGHT NOW:** Ask the user the two path-determination questions below. Do NOT create todos, run commands, or read further until the user has answered both questions. After both answers are received, create all todos for the determined path and mark Todo 1 in-progress.
+> **YOUR FIRST AND ONLY ACTION RIGHT NOW:** Ask the user the three path-determination questions below. Do NOT create todos, run commands, or read further until the user has answered all three questions. After all answers are received, create all todos for the determined path and mark Todo 1 in-progress.
 
-**RULE 1 — ASK TWO QUESTIONS FIRST, THEN CREATE ALL TODOS.**
+**RULE 1 — ASK THREE QUESTIONS FIRST, THEN CREATE ALL TODOS.**
 
-Before creating any todos or running any commands, ask the user these two questions (one at a time, wait for each response):
+Before creating any todos or running any commands, ask the user these three questions (one at a time, wait for each response):
 
 **Question 1: Is your agent already available in Teams or Copilot?**
 
@@ -19,25 +19,41 @@ Wait for the answer. Store as `agentType`:
 - If **Yes**: `agentType = 1` (M365 custom engine agent)
 - If **No**: `agentType = 2` (All other agents)
 
-**Question 2: What capabilities do you want to enable?**
+**Question 2: How will your agent authenticate when calling downstream APIs?**
 
-Present only the options that apply to the user's `agentType`:
+1. On-behalf-of (OBO) — the agent acts as the signed-in user (delegated permissions)
+2. Service-to-service (S2S) — the agent acts as its own identity (application permissions)
+3. Both (OBO and S2S)
 
-- **If `agentType = 1`** (M365 — Discoverability is already included):
-  1. Observability
-  2. Work IQ
-  3. AI Teammate
+Provide this context to help the developer choose:
+- **OBO**: Choose this when your agent needs to access resources on behalf of a specific user — for example, reading the user's calendar or sending mail as them.
+- **S2S**: Choose this when your agent runs unattended or needs to access tenant-wide resources independently of any signed-in user — for example, reading all mailboxes or managing SharePoint sites.
+- **Both**: Choose this when your agent needs to support both modes.
+
+Wait for the answer. Store as `authMode`:
+- If **1 (OBO)**: `authMode = "obo"`
+- If **2 (S2S)**: `authMode = "s2s"`
+- If **3 (Both)**: `authMode = "both"`
+
+**Question 3: What Agent 365 capabilities do you want to enable?**
+
+Present only the options that apply to the user's `agentType` **and** `authMode`.
+
+- **If `agentType = 1`**:
+  - `authMode = "obo"` or `"both"` or `"s2s"`:
+    1. Observability
+    2. AI Teammate
 - **If `agentType = 2`** (All other agents):
-  1. Discoverability
-  2. Observability
-  3. Work IQ
-  4. AI Teammate
+  - `authMode = "obo"` or `"both"` or `"s2s"`:
+    1. Register
+    2. Observability
+    3. AI Teammate
 
 Wait for the answer. Store as `capabilities`.
 
 > **Note:** The setup automatically includes all prerequisite capabilities for your selection.
 
-After both questions are answered, set `isAiTeammate = true` if `capabilities = AI Teammate`, else `isAiTeammate = false`. Then create all todos for the path and mark Todo 1 in-progress:
+After all three questions are answered, set `isAiTeammate = true` if `capabilities = AI Teammate`, else `isAiTeammate = false`. Then create all todos for the path and mark Todo 1 in-progress:
 
 **AI Teammate agent path** — `isAiTeammate = true` (5 todos total):
 - Todo 1: `Step 1: Verify and Install/Update the Agent 365 CLI`
@@ -55,7 +71,7 @@ After both questions are answered, set `isAiTeammate = true` if `capabilities =
 
 **RULE 3 — SUB-SECTIONS ARE NOT SEPARATE TODOS.** Each `## Step` has internal sub-sections — these are tasks WITHIN that step, NOT separate todos.
 
-**RULE 4 — ONE STEP AT A TIME.** Complete each step fully. Mark its todo in-progress when starting, complete when done. Do NOT run `az account show`, ask about deployment type, or gather Azure values — those belong to Steps 3 and 2 respectively. The path determination questions (`agentType`, `capabilities`) were already answered before Step 1.
+**RULE 4 — ONE STEP AT A TIME.** Complete each step fully. Mark its todo in-progress when starting, complete when done. Do NOT run `az account show`, ask about deployment type, or gather Azure values — those belong to Steps 3 and 2 respectively. The path determination questions (`agentType`, `capabilities`, `authMode`) were already answered before Step 1.
 
 **RULE 6 — SILENT EXECUTION.** Work silently. Do NOT narrate what you are about to do, announce step transitions ("Proceeding to Step 2", "CLI installed, moving on"), print todo state, emoji checklists, or step completion summaries. Only speak to the user when you need input, have an error to report, or need confirmation before a destructive action.
 
@@ -224,7 +240,7 @@ pip --version
 
 ## Step 3: Configure the Agent 365 CLI (Initialize Configuration)
 
-> **AI TEAMMATE AGENT PATH ONLY** (`capabilities = AI Teammate`, `isAiTeammate = true`).
+> **AI Teammate path ONLY** (`capabilities = AI Teammate`, `isAiTeammate = true`).
 >
 > If `isAiTeammate = false` (Standard path), you should NOT be here. Go back, mark Todo 3 (Step 4) in-progress, and jump directly to Step 4.
 >
@@ -413,7 +429,7 @@ After `a365 setup all` completes, show the user exactly this — nothing more, n
 
 Mark all todos as completed, then check `capabilities`:
 
-> **If `capabilities` includes "Observability"** (`agentType = 1` with Observability or Work IQ, or `agentType = 2` with Observability or Work IQ): immediately start following `#file:a365-observability-instructions.md`. The user already selected observability — do NOT ask again, just proceed.
+> **If `capabilities` includes "Observability"** (`agentType = 1` with Observability, or `agentType = 2` with Observability): immediately start following `#file:a365-observability-instructions.md`. The user already selected observability — do NOT ask again, just proceed.
 >
 > **Otherwise**: say to the user verbatim:
 > "Your agent is provisioned. Would you like to add observability so you can trace LLM calls, tool dispatches, and agent-to-agent calls?"
@@ -424,7 +440,7 @@ Mark all todos as completed, then check `capabilities`:
 
 ## Step 5: Publish and Deploy the Agent Application
 
-> **AI TEAMMATE AGENT PATH ONLY.** This step does not exist on the Standard path. If `isAiTeammate = false`, you should not be here.
+> **AI Teammate path ONLY.** This step does not exist on the Standard path. If `isAiTeammate = false`, you should not be here.
 
 At this stage, your agent is set up. You should be able to see your agent in Microsoft Admin Center Agent Registry. Observability will be added after this step completes.