A new arXiv paper proposes something sharper than most agent-identity schemes floating around this year: instead of just verifying who deployed an agent, it tries to cryptographically prove which exact code is running. The paper, BAID (Binding Agent ID), starts from a specific complaint about existing agent registries and auth systems. Most of them solve "agent-to-system" trust — confirming an agent is a valid, recognized entity on a network — but skip the harder problem of tying an agent's actions back to a specific accountable human. Traditional key-based authentication doesn't help much here, since a key proves possession of a secret, not who's holding it or whether the code doing the acting is the code that was authorized. BAID's answer combines three mechanisms: local binding via biometric authentication, decentralized on-chain identity management, and what it calls a zkVM-based Code-Level Authentication protocol. The last piece is the interesting one. By running recursive zero-knowledge proofs over the program binary, the system can generate cryptographic guarantees not just about who's operating an agent, but about the integrity of the agent's actual configuration and its complete execution history. The framing is deliberate: the binary itself becomes the identity, not a certificate issued to whatever happens to be running. That distinction matters for a failure mode that's been underdiscussed compared to "who authorized this agent" — silent code substitution. An operator can be biometrically verified and still hand off execution to a modified binary, a swapped model checkpoint, or a compromised deployment pipeline, and none of the identity layers built around human authorization would catch it. BAID's pitch is that treating execution provenance as a first-class, provable fact — not an assumption baked into whichever key signed a request — closes that gap. The paper is explicit that it's targeting a dual binding: local, biometric-anchored human accountability paired with on-chain identity verification, so that both the operator and the code they're running can be independently checked. Whether the zkVM approach is practical at the latency and cost agents actually run at is an open question the paper doesn't fully resolve — recursive proof generation isn't free, and production agent systems tend to be latency-sensitive. But the framing itself — separating "is this the right person" from "is this the right code" as two distinct, independently provable claims — is a cleaner decomposition of the accountability problem than most identity proposals bother with.