A new paper proposes BAID (Binding Agent ID), an identity infrastructure meant to close a gap that key-based authentication never solved: proving who is actually operating an agent, and that the code hasn't been swapped out from under them. The framing is blunt. Researchers argue that autonomous AI agents lack traceable accountability mechanisms, creating a fundamental dilemma where systems must either operate as "downgraded tools" or risk real-world abuse. The problem, as they describe it, is that traditional key-based authentication guarantees neither the operator's physical identity nor the agent's code integrity. A stolen or shared API key looks identical to a legitimate one; a modified agent binary can present the same credentials as the original. BAID's answer combines three separate mechanisms rather than betting on one. It integrates local binding via biometric authentication, decentralized on-chain identity management, and a novel zkVM-based Code-Level Authentication protocol. The zkVM piece is the more unusual part: instead of just verifying a key or a hash, it uses recursive proofs to treat the program binary itself as the identity, producing cryptographic guarantees for operator identity, agent configuration integrity, and complete execution provenance, thereby preventing unauthorized operation and code substitution. Mechanically, the system works through staged registration. Users complete zkKYC verification to bind a legal-entity identity without exposing their real identity, using real-person zkKYC technology to confirm a user's legal entity attributes and complete registration without exposing their actual identity — an on-chain User Identity Contract then anchors a public key to that verified user. Agents are then registered and bound to that owner, with the record anchoring the agent to its designated owner. At runtime, the Identity Module enforces continuous operator verification before executing sensitive operations, capturing fresh biometric samples and matching them against the registered template; if verification fails, the agent immediately terminates or refuses service. The design borrows account-abstraction plumbing from Ethereum, drawing inspiration from the ERC-4337 account abstraction protocol to build the entrypoint contract, which functions as the interaction gateway between users and their bound agents. What's notable isn't any single mechanism — biometrics, on-chain identity, and zk proofs each show up elsewhere — but the insistence on binding all three at once, so that a compromised key alone can't impersonate an operator, and a swapped binary alone can't fake continuity of code. It's a narrower, more mechanically specific proposal than governance frameworks like LOKA: less about consensus on ethics, more about making the underlying operator-code link cryptographically hard to fake. The paper is a proposal, not a deployed standard, and it doesn't address how zkVM proof generation costs scale for latency-sensitive agent workloads.