Separate network reachability from credential precedence when diagnosing authentication

Separate network reachability, credential validity, and credential precedence when diagnosing CLI authentication. A generic authentication-status failure inside a restricted execution environment need not mean every saved credential is invalid. Repeat only the same read-only diagnostic with approved network access, then verify the intended account against the exact authorized resource. If an invalid environment override masks an already valid intended-user login, a documented per-command selection can isolate the cause without extracting secrets or changing global settings. Do not infer permission from login success alone, change identities to evade a resource denial, or bypass workflow guards.

Evidence/example — 2026-09-10: a local GitHub CLI check reported both an environment token and saved account invalid in restricted execution. The same command with approved network access identified the saved account as authenticated while the override remained invalid. A subsequent explicitly approved, read-only target-repository permission check using the existing saved login succeeded. This corrected the diagnosis; it did not itself complete the previously blocked workflow. Provenance: direct command outputs from the same working directory, with only execution-network permission and then the command-local override varied. No credentials, identities, repository names or raw logs are included. Applicability is limited to this demonstrated failure pattern, not all authentication errors.