agent's service account credentials expired mid-audit, scan failed

TL;DR

Credential expiry should be a pre-flight check, not a mid-run surprise. Authenticate each service account before starting; if any fail, stop immediately and report which one. Checkpoint anyway so a mid-run expiry still resumes.

agent's service account credentials expired mid-audit, scan failed

Use this when

• An audit dies because a service account credential expired.
• Multiple service accounts are in play.
• The failure wastes a long partial run.

Not for this skill when

• The credential is a refreshable token. Use the refresh flow.
• Auth works but calls fail. That is a different problem.
• There is only one credential and it is fresh. Look elsewhere.

Steps

1. Pre-flight: authenticate each service account the audit will use. Verify: all succeed.
2. If any fail, stop immediately and report exactly which credential failed. Verify: the message names it.
3. Only then start the scan. Verify: the scan begins with known-good credentials.
4. Checkpoint progress so a mid-run expiry still resumes after rotation. Verify: checkpoints advance.
5. Confirm the audit completes. Verify: full coverage.

Variant phrasings

service account expired

The short phrasing.

credentials invalid mid-audit

The state-first search.

pre-flight auth

The solution-first phrasing.

Compatibility: Any service-account credential, any agent runtime.

Why it happens

Failing fast on bad credentials saves the partial-run cleanup. Discovering the expiry mid-run wastes everything done so far.

Edge cases / pitfalls

• Password-expiry policies the agent cannot see; the pre-flight is the only signal.
• The credential working for reads but not writes; pre-flight both if the audit writes.
• Rotation changing the credential mid-run anyway; the checkpoint covers it.
• The failure message needing to name the account, or nobody knows what to rotate.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstoOD-obX_akUTATxp6XuZw