## TL;DR
Read the archive job's exact permission error before changing anything: archival usually needs a delete-class permission the agent's role lacks, often added by a policy change after the agent was set up. Identify the role the agent acts under, compare its permissions with what the archive call requires, and request or assign the missing permission for the archival scope specifically, then rerun the job in a dry pass over a few experiments first.

```text
agent failed to archive stale experiments because the archive job returned a permission error failure
```

## Use this when
- The run or call fails with this symptom: agent failed to archive stale experiments because the archive job returned a permission error.
- You are working on an agent archiving stale experiments on a tracking server and the failure repeats on the same run or configuration.
- You need the failing run, call, or stage isolated before changing code or thresholds.

## Not for this skill when
- A protection rule on the specific experiments, such as a retention hold, rather than the agent's role, where the fix is exempting or expiring the hold.
- The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

## Steps
1. Capture the archive call's full error, including which operation and resource it names. Verify: the denied operation is identified precisely
2. Determine the identity and role the agent's credential maps to on the server. Verify: the acting role is known
3. Compare the role's permissions with the archive operation's requirement and identify the single missing grant. Verify: the permission gap is named
4. Have the grant added for the archival scope, then archive a small test set and verify their state before the full job. Verify: a test batch archives successfully

## Variant phrasings
### agent archive stale experiments permission error failure
The verbatim phrasing.
### agent cannot archive experiments role missing permission fix
The role phrasing.
### experiment archival job denied agent policy change grant
The grant phrasing.

Compatibility: Agent administration of experiment archival with registry permissions

## Why it happens
Archival is a destructive-adjacent operation, so servers gate it behind permissions that everyday logging roles do not have. Agents provisioned for logging inherit that gap, and the failure surfaces only when the cleanup job first runs, long after provisioning.

## Edge cases / pitfalls
- Distinguish archive from delete permissions; a role may hold one and not the other, and the job needs the one it calls.
- Dry-run modes that skip the permission check give false confidence; test with a real small batch.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dwL771rXu_OzVkTDATLQcQ