A housing authority finds an unused agent that still has broad access. What should admins do as part of lifecycle monitoring?

Housing authority admins should retire or remove the unused agent that still has broad access so residual risk is reduced. Lifecycle monitoring is not passive observation: when an agent is unused yet retains broad invoke rights, it remains an attack and misuse surface without delivering municipal value. Retirement or removal closes that residual risk as a standard hygiene outcome of monitoring. Revoking the agent session tokens promptly so residual risk is reduced pending final review fails because token revocation only ends active sessions—it does not remove the broad invoke rights or retire the unused agent, so residual risk remains until final removal. Placing the unused agent on extended review monitoring so residual risk is tracked over time fails because extended monitoring is passive observation—tracking over time does not reduce broad access or close the unused attack surface that lifecycle monitoring requires retiring. Reducing the agent alert priority to low so residual risk from broad access stays contained fails because lowering priority does not contain risk—it only reduces visibility while the unused agent retains broad access, allowing misuse to go undetected. Exam caveat: Domain 3 connects agent lifecycle monitoring to actions such as retiring unused agents and reducing over-broad access. On the exam, prefer risk-reducing retirement over revoking session tokens pending final review, placing the agent on extended review monitoring, or reducing alert priority to low. Operational check: Confirm the housing agent shows unused or near-zero invocation in monitoring, verify no critical dependency remains, remove broad audience assignments, retire or delete the agent per municipal policy, document the change, and re-scan for other unused agents with oversized access on the next lifecycle pass.