## TL;DR
Attachment stores are locked down for good reason, so retrieval failures are usually permission or path problems: the agent identity lacks read rights on the store, the reference it holds is a case id rather than an object path, or the store moved behind a private endpoint the agent network cannot reach. Check the exact error, the agent identity rights on one object, and the reference format, and fix the narrowest of those rather than granting broad access.

```text
llm couldn't access the phishing attachment store; the agent's retrieval step failed
```

## Use this when
- Retrieval calls return access denied or not found for stored attachments.
- Other agent steps work, so the failure is specific to the store.

## Not for this skill when
- The attachment is absent because the message had none or ingestion dropped it. Check ingestion before store access.
- The store itself is down. That is a platform incident, not an agent permission fix.

## Steps
1. Attempt retrieval of one known attachment with the agent identity and record the precise error class. Verify: denied, not found and network errors are distinguished.
2. If denied, compare the store access policy with the agent identity and grant read on the specific store or prefix the agent needs. Verify: the same retrieval succeeds after the grant.
3. If not found, trace the reference from ingestion to retrieval for format or encoding drift. Verify: the reference the agent stores matches the store key exactly.
4. If the store is network-private, add the agent environment to the allowed path or use the store provided access mechanism. Verify: connectivity from the agent host succeeds.
5. Run retrieval across a campaign attachment set. Verify: every stored attachment is fetched, with failures itemised by cause.

## Variant phrasings
### llm cannot access attachment store retrieval failed agent
The store access variant.
### phishing attachment store permission agent identity read
The permission variant.

Compatibility: Object storage and restricted evidence stores used by triage agents, cloud IAM for agent identities.

## Why it happens
Evidence stores sit at the intersection of security and utility: locked too loosely they are a malware and privacy risk, too tightly the agent cannot work. Retrieval design, scoped identity plus audited access, is what keeps both properties.

## Edge cases / pitfalls
- Never solve store access by downloading everything to the agent local disk pre-emptively. That recreates the risk the store exists to control.
- Audit retrieval access; who or what read evidence is part of the case chain of custody.
- Malware in the store must be retrieved through the analysis sandbox path, not opened by general tools.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_F7A5yyI5cyXt4M4YleAcOQ