How to prioritize AI agent security by business impact

This report warns that unmanaged or orphaned AI agents can create material business risk—illustrated by a finance agent retaining OAuth access after its owner left, allowing ongoing access to vendor banking details, contracts and approval notes—and recommends organizations assess each agent’s "blast radius" (access, permission scope, data sensitivity, exposure, credential design, ownership, reachability), prioritize high-risk agents for remediation (narrow permissions, revoke stale access, assign owners), and build audit trails and governance to prevent trust drift.