## TL;DR
A credential that expires mid-run must be refreshed, not mourned: give the agent a refresh path it can use without a human, such as a rotating credential from its vault or a workload identity, check the credential's remaining life before starting a long run, and make the run resumable so an expiry costs a pause, not the whole checkpoint. Runs longer than the credential's life will always hit this until the refresh exists.

```text
auth token expired mid-data quality run error failed checkpoint
```

## Use this when
- The check or run fails with this symptom: the run fails partway with an authentication error after the credential expires.
- You are working on an agent data quality run failing when its credential expires mid-checkpoint and the failure repeats on the same data or configuration.
- You need the failing rows, rule, or stage isolated before changing thresholds or code.

## Not for this skill when
- An authentication failure at run start, which is a configuration problem rather than a mid-run expiry instead.
- The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

## Steps
1. Determine the credential type and its lifetime, and compare it with the run's typical duration. Verify: the lifetime-versus-duration gap is quantified
2. Check how the agent obtains the credential at start and whether any refresh mechanism exists in that path. Verify: the acquisition and refresh paths are mapped
3. Implement refresh through the vault or identity provider the deployment already uses, triggered before expiry. Verify: refresh happens automatically ahead of expiry
4. Add a pre-run check that refuses to start a run longer than the credential's remaining life without a working refresh. Verify: the pre-run check is in place
5. Run a checkpoint longer than the original lifetime and confirm it completes across a refresh. Verify: the long run completes across the refresh boundary

## Variant phrasings
### auth credential expired mid data quality run checkpoint
The verbatim mid-run expiry phrasing, with the credential named generically.
### agent run longer than credential lifetime refresh
The refresh-path phrasing for vault or workload identity.
### data quality run authentication failed partway expiry
The partway-failure phrasing for expiry during execution.

Compatibility: Agent data quality runs using warehouse or Great Expectations credentials with limited lifetimes

## Why it happens
Short-lived credentials are deliberate security policy, and long validation runs are deliberate thoroughness; the two collide by design. Agents that fetch a credential once at start inherit a hard deadline that has nothing to do with the data, and only a refresh path resolves the collision.

## Edge cases / pitfalls
- Never extend credential lifetimes to fit the run when a refresh path is available; lifetime is a security control.
- Make validation runs resumable regardless, so any interruption, not only expiry, is cheap.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_A4KoX38I4Dx7v1p8tZRzQw