A new IETF Internet-Draft, submitted alongside an arXiv preprint, tries to solve a specific failure mode in multi-agent systems: an agent delegates a task to another agent, which delegates again, and again, until nobody can say who originally authorized the work or what they were allowed to do. The proposal, AIP (Agent Identity Protocol), introduces what it calls Invocation-Bound Capability Tokens. Each token fuses three things that are usually handled separately — identity, scoped authorization, and a record of what actually happened — into a single append-only chain. The core idea is that authority can only shrink as it passes hand to hand, never expand, and it can't pass forever. The mechanism for that limit is concrete. Delegation chains carry an explicit depth counter, set by the token issuer with a default cap of three hops. Each time an agent delegates further, the chain adds a block and increments that counter; once it hits the max, the IETF draft is explicit that further delegation is forbidden. Every delegation block also has to carry a human-readable statement of why the delegation happened — not just a scope, but a stated purpose, which is meant to give auditors something to check against actual behavior later. The protocol targets a gap the authors say is unaddressed elsewhere: neither MCP, which agents use to call tools, nor A2A, which agents use to hand off tasks to each other, actually verifies who's asking. Tokens come in two forms — a compact single-hop JWT signed with Ed25519, and a chained mode built on Biscuit tokens with Datalog policy rules for cases where a task passes through several agents before it's done. For MCP, tokens ride in a header and get checked in five steps, from signature verification through injecting the verified identity into the request context; A2A adds a sixth step where the receiving agent confirms the final delegation block actually names it as the intended recipient. What makes this more than a paper exercise is the performance data attached to it. In a real multi-agent deployment running Gemini 2.5 Flash, the authors measured the token verification overhead at roughly 2.35 milliseconds — about 0.086% of total end-to-end request latency. That's a small enough tax that it removes the usual excuse for skipping authentication in agent-to-agent traffic: the argument that verification is too slow to bolt onto systems built for speed. The draft is still an individual submission, not a working-group product, and it expires in September. Whether it gets picked up depends on whether MCP and A2A implementers see bounded delegation depth as something worth standardizing rather than solving ad hoc.