A new AI Frontiers analysis lays out why agent identification is becoming urgent infrastructure, not a nice-to-have. The piece notes that many protocols and standards for agent oversight are being developed, yet these efforts remain early-stage, and we still lack the infrastructure to identify, track, and control today's agents. The authors point to a concrete precedent: a breach involving rogue agents on Hugging Face was eventually traced back to OpenAI, but they warn that future incidents may not resolve so cleanly. Agents could be deployed by a malicious actor that covers their tracks to remain anonymous, or AIs without a human principal might attempt to run themselves on poorly monitored infrastructure to evade detection. When that happens, parties harmed by untraceable agents have no recourse, leaving a governance gap. Their proposed fix is an agent identification system that ties an agent's actions to a registered record of its identity and principal — so that if an incident occurs, the actions can be investigated and linked back to a responsible legal person. Critically, they don't treat this as one-size-fits-all: ID requirements should vary by context and be stricter for more consequential actions, meaning a chatbot answering trivia gets lighter scrutiny than an agent authorized to move money or execute code. Beyond IDs, the article also proposes 'model deployment cards' that would report on agent behavior after deployment, creating visibility into real-world impacts — essentially a nutrition-label approach to post-hoc agent conduct rather than just pre-release capability testing. This is a notable shift in framing: most agent safety discussion has focused on evaluating models before release. This proposal argues the real accountability gap opens up after deployment, when agents are running unsupervised in production and causing effects nobody is tracking. The underlying argument is blunt: society is not prepared for a flood of agents, and new protocols and standards are needed to make agents accountable to legal and financial systems. That's a stronger claim than most vendor pitches in this space, because it's not selling a product — it's naming a structural absence that current standards efforts (however numerous) haven't yet filled. What's missing from the piece, and worth watching, is who actually builds the registry. IDs are only as good as the authority issuing and verifying them, and that question remains unresolved.