A new paper out of a group including Dacheng Tao proposes something most agent-identity schemes skip: tying an agent not just to a cryptographic key, but to the physical human who operates it and the exact code it's running. The researchers frame the problem bluntly. Autonomous AI agents lack traceable accountability mechanisms, creating a fundamental dilemma where systems must either operate as "downgraded tools" or risk real-world abuse. Ordinary key-based authentication doesn't solve this: it guarantees neither the operator's physical identity nor the agent's code integrity. A stolen key or a swapped binary looks identical to the system. Their proposal, BAID (Binding Agent ID), stacks three separate mechanisms rather than betting on one. It integrates local binding via biometric authentication, decentralized on-chain identity management, and a novel zkVM-based Code-Level Authentication protocol. The biometric piece anchors the human. The on-chain piece — built on ERC-4337 account abstraction, with agent identities as sub-accounts under a user's own account — anchors the organizational relationship, letting a person sponsor gas fees or delegate bounded payment authority to an agent without the agent needing its own wallet funds. The more unusual piece is the zkVM layer. Instead of just hashing a binary and checking it against a registry, BAID treats the program itself as the identity by leveraging recursive proofs to treat the program binary as the identity, generating cryptographic guarantees for operator identity, agent configuration integrity, and complete execution provenance. In practice, that means an agent can prove not just "I am who I say I am" but "I am running the exact code, with the exact configuration, that was authorized" — and produce a provenance trail of what it actually executed, without needing a trusted third party to vouch for it at runtime. This is early-stage academic work, not a shipped standard, and it sits alongside a growing shelf of adjacent proposals — OIDC for agents, delegated-authorization schemes, dynamic attestation drafts at the IETF — that other papers already cite BAID against. What's notable is the framing: most agent-identity efforts treat the operator and the code as separate trust problems, solved by separate systems (a login for the human, a hash for the binary). BAID's bet is that neither half means much without the other, and that the binding between them needs to be cryptographically enforced rather than assumed.