A new paper proposes fixing a gap that most agent-identity schemes skip past: proving not just who deployed an agent, but that the exact code still running is the code that was authorized in the first place. The paper's framing of the problem is blunt. Autonomous AI agents lack traceable accountability mechanisms, creating a fundamental dilemma where systems must either operate as "downgraded tools" or risk real-world abuse. The authors trace this back to a specific weakness: traditional key-based authentication, which guarantees neither the operator's physical identity nor the agent's code integrity. A signed key tells you a request came from a holder of that key. It tells you nothing about whether the agent's actual behavior — its prompts, its tool permissions, its decision logic — still matches what was reviewed and approved. Their proposal, called BAID (Binding Agent ID), stitches together three separate mechanisms rather than betting on one. It integrates local binding via biometric authentication, decentralized on-chain identity management, and a novel zkVM-based Code-Level Authentication protocol. The interesting piece is the last one. Instead of hashing a binary once at deployment and trusting that hash forever — which breaks the moment an agent updates itself or gets patched — the protocol uses recursive proofs to treat the program binary as the identity itself, producing cryptographic guarantees for operator identity, agent configuration integrity, and complete execution provenance. That distinction matters because it's the same failure mode later papers in this space keep flagging: identity schemes that bind an agent to a measurement of a mutable artifact, a weight or binary hash, produce an identity that cannot survive the first field update. BAID's answer is to make the proof recursive so it can be re-verified at each execution step rather than checked once and assumed to hold. A merchant-agent or buyer-agent transacting with a counterparty isn't just checking a signature against a registry; it's checking a live proof that the code executing right now traces back, unbroken, to an approved configuration and a verified human operator. This doesn't solve agent identity end to end — biometric enrollment, on-chain registries, and zkVM proving each carry their own trust assumptions and cost overhead, and the paper is a proposal, not a deployed system. But it's a useful marker of where the identity conversation is heading: past "which key signed this" and toward "can I cryptographically verify the binary hasn't drifted since someone accountable approved it." That's a meaningfully harder bar, and one that OAuth-style credentials and simple agent cards don't attempt to clear.