Most agent-identity proposals treat the human-in-the-loop question abstractly: an operator authorized this agent, trust us. A new paper from researchers at Michigan State proposes something more concrete: cryptographically fuse a person's face biometric directly into the agent's authorization token, so the token itself becomes evidence of who delegated what. The framework, called BIND, targets a specific failure mode: an AI agent performing a critical task with no verifiable link back to a real human who approved it. The paper frames this as an accountability gap that plain key-based auth doesn't close, since a key proves nothing about the physical person behind it. BIND's mechanism binds biometric data of the human user to the AI agent identity (ID) and authority scope (task-specific constraints) at the time of agent authorization. The resulting token can later be handed to what the authors call an Identity Auditor, who checks it and recovers both the agent ID and the authorized scope, producing a non-repudiable proof of human control and delegation of authority. The technical trick is turning a face embedding, normally a noisy, high-precision vector, into something that behaves like a cryptographic key. The authors built a feature adaptation module that converts real-valued face embeddings into fixed-length binary strings suitable for a fuzzy commitment scheme built on turbo error-correcting codes — the same family of error correction used in wireless and satellite links, repurposed here to tolerate the natural noise in a face scan while still producing a stable, reproducible secret. They report a working prototype rather than just a design: a True Match Rate of 96% at zero False Match Rate, and support for 1024-bit agent tokens built from that face-derived secret. What's notable isn't the accuracy number so much as where the paper places its trust anchor. Rather than trusting an operator's account, a device certificate, or a signed attestation from the agent's runtime, it trusts a physical, non-transferable characteristic of the person and mechanically welds it to the scope of what the agent was allowed to do. That closes off delegation-boundary problems other schemes leave open, such as OAuth tokens getting forwarded past the scope a user originally approved in asynchronous multi-agent pipelines. It also raises the obvious question the paper doesn't fully resolve: what happens when the Identity Auditor itself is compromised, or when the biometric template needs to be revoked.