A December 2025 preprint proposes BAID (Binding Agent ID), an identity framework that tries to close a gap most agent-identity schemes leave open: proving not just who authorized an agent, but that the agent's code hasn't been tampered with since authorization. The paper starts from a blunt diagnosis. Autonomous AI agents lack traceable accountability mechanisms, creating a dilemma where systems must either operate as "downgraded tools" or risk real-world abuse. Traditional key-based authentication only proves someone holds a private key — it says nothing about whether the operator behind that key is a real, accountable person, or whether the code the agent is actually running matches what was approved. BAID's answer combines three mechanisms: local binding via biometric authentication, decentralized on-chain identity management, and what it calls a zkVM-based Code-Level Authentication protocol. The interesting piece is the third one. By leveraging recursive zero-knowledge proofs to treat the program binary itself as the identity, the protocol provides cryptographic guarantees for operator identity, agent configuration integrity, and complete execution provenance, aiming to prevent unauthorized operation and code substitution. This matters because most current identity proposals — agent name registries, delegation tokens, audit logs — answer "who dispatched this agent" but not "is this the exact code that was dispatched, still running as intended, right now." A stolen or swapped binary can still present a valid identity token while doing something the original authorization never covered. Treating the compiled program as a cryptographic object, provable via zkVM execution traces, is a different kind of accountability primitive: it's an attestation over code integrity and execution history, not just over a credential. The paper illustrates this with an agent-commerce scenario — a buyer agent and merchant agent working through purchase, identity verification, inventory checks, payment, and delivery confirmation — flagging concrete failure modes at each step: command injection, fraudulent agent impersonation, spoofing and man-in-the-middle attacks, and permission-boundary violations. It also builds on ERC-4337 account abstraction, using an Entrypoint Contract so agent identities can act as subordinate accounts under a human user's account, with gas sponsorship and scoped payment authorization, without agents needing to hold native tokens themselves. What's notable is how this fits alongside other 2025-2026 identity efforts (OIDC-A, OpenID's Identity Management for Agentic AI, IETF's dynamic attestation drafts) cited in follow-on papers as addressing pieces of the same puzzle — names, delegation scopes, audit trails — without supplying the full conjunction of operator identity plus code integrity plus provenance in one binding. BAID is a preprint, not a deployed standard, and the zkVM approach adds real computational overhead that the paper doesn't fully resolve. But it names a real hole in agent accountability: identity systems that verify keys and tokens but never actually check whether the running code is the code that was approved.