## TL;DR

Continuing to scan after auth fails produces unauthenticated, incomplete results that look complete. Fail closed: on auth errors, stop the run, mark results partial, and alert.

## Error

```text
agent's vault token expired mid-run and it kept scanning unauthenticated: auth error
```

## Steps

1. Confirm the silent continuation: logs show auth failures followed by more scanning. Expected: the fail-open proven.
2. Add an auth check before each phase; on failure, halt. Expected: fail-closed behavior.
3. Mark any results gathered after the auth failure as partial and untrusted. Expected: honest reporting.
4. Alert on auth failures immediately; they may indicate revocation, not just expiry. Expected: fast response.
5. Re-run the affected phases with valid auth. Expected: trustworthy results.

## When to use

- Agents continuing after auth failures.
- Building fail-closed automation.

## When not to use

- Permission errors with valid auth (different handling).
- Intentional unauthenticated phases (then mark them as such).

## Tool compatibility

- Vault auth; agent run control.

## Variant phrasings

### agent scanned without auth

Fail closed.

### expired token but scan continued

Halt and mark partial.

## Why it happens

Error handling that logs and continues turns auth failures into silent data gaps.

## Edge cases

- Distinguish expiry (refresh and resume) from revocation (stop and investigate).
- Partial results must never be presented as complete.
- Auth checks cost little; run them often.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YZfH962CuyXtMowXmyEuYg