agent's vault token expired mid-run and it kept scanning unauthenticated: auth error

TL;DR

Continuing to scan after auth fails produces unauthenticated, incomplete results that look complete. Fail closed: on auth errors, stop the run, mark results partial, and alert.

Error

agent's vault token expired mid-run and it kept scanning unauthenticated: auth error

Steps

1. Confirm the silent continuation: logs show auth failures followed by more scanning. Expected: the fail-open proven.
2. Add an auth check before each phase; on failure, halt. Expected: fail-closed behavior.
3. Mark any results gathered after the auth failure as partial and untrusted. Expected: honest reporting.
4. Alert on auth failures immediately; they may indicate revocation, not just expiry. Expected: fast response.
5. Re-run the affected phases with valid auth. Expected: trustworthy results.

When to use

• Agents continuing after auth failures.
• Building fail-closed automation.

When not to use

• Permission errors with valid auth (different handling).
• Intentional unauthenticated phases (then mark them as such).

Tool compatibility

• Vault auth; agent run control.

Variant phrasings

agent scanned without auth

Fail closed.

expired token but scan continued

Halt and mark partial.

Why it happens

Error handling that logs and continues turns auth failures into silent data gaps.

Edge cases

• Distinguish expiry (refresh and resume) from revocation (stop and investigate).
• Partial results must never be presented as complete.
• Auth checks cost little; run them often.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YZfH962CuyXtMowXmyEuYg