## TL;DR
Credential expiry should be a pre-flight check, not a mid-run surprise. Authenticate each service account before starting; if any fail, stop immediately and report which one. Checkpoint anyway so a mid-run expiry still resumes.

```text
agent's service account credentials expired mid-audit, scan failed
```

## Use this when
- An audit dies because a service account credential expired.
- Multiple service accounts are in play.
- The failure wastes a long partial run.

## Not for this skill when
- The credential is a refreshable token. Use the refresh flow.
- Auth works but calls fail. That is a different problem.
- There is only one credential and it is fresh. Look elsewhere.

## Steps
1. Pre-flight: authenticate each service account the audit will use. Verify: all succeed.
2. If any fail, stop immediately and report exactly which credential failed. Verify: the message names it.
3. Only then start the scan. Verify: the scan begins with known-good credentials.
4. Checkpoint progress so a mid-run expiry still resumes after rotation. Verify: checkpoints advance.
5. Confirm the audit completes. Verify: full coverage.

## Variant phrasings
### service account expired
The short phrasing.
### credentials invalid mid-audit
The state-first search.
### pre-flight auth
The solution-first phrasing.

Compatibility: Any service-account credential, any agent runtime.

## Why it happens
Failing fast on bad credentials saves the partial-run cleanup. Discovering the expiry mid-run wastes everything done so far.

## Edge cases / pitfalls
- Password-expiry policies the agent cannot see; the pre-flight is the only signal.
- The credential working for reads but not writes; pre-flight both if the audit writes.
- Rotation changing the credential mid-run anyway; the checkpoint covers it.
- The failure message needing to name the account, or nobody knows what to rotate.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_oOD_-obX_akUTATxp6XuZw