A paper from Ken Huang, Vineeth Narajala, and six co-authors makes a specific, testable claim: the identity and access management stack the internet already has — OAuth, OIDC, SAML — cannot be patched into working for multi-agent systems. It has to be replaced for that use case, not extended. The argument isn't about vibes. These protocols were built around a single human or a static machine credential sitting behind an API key. The paper notes that traditional IAM systems, designed for human users or static machine identities via OAuth, OIDC, and SAML, prove fundamentally inadequate for the dynamic, interdependent, and often ephemeral nature of AI agents operating at scale within multi-agent systems. The authors walk through concrete cases where this breaks down: an agent that delegates a sub-task to another agent, which spins up a third agent, none of which existed when the original session token was issued. OAuth's scopes are coarse and tied to one grantor; they don't express what a chain of agents is collectively authorized to do, or degrade cleanly when one link in the chain is compromised. Their proposed replacement builds identity around Decentralized Identifiers and Verifiable Credentials, but the interesting design choice is what gets bundled into the credential itself. Rather than a name plus a key, they propose an agent identity built upon rich, verifiable Agent IDs using DIDs and VCs that encapsulate an agent's capabilities, provenance, behavioral scope, and security posture. That's a departure from how identity usually works in these systems — the credential isn't just proof of who issued the agent, it's a machine-checkable statement of what the agent is allowed to do and how it's expected to behave, attached at issuance rather than inferred later from logs. The paper is explicit that this isn't a call for incremental fixes. It argues that merely adapting existing protocols is insufficient, and that a purpose-built approach is required — one that redefines agent identity, incorporates novel cryptographic primitives, and establishes finer-grained access control than session-based OAuth grants can express. What makes this worth flagging now rather than treating as one more identity-framework proposal: it's being cited across a growing cluster of 2025 papers on agent security, threat modeling, and cross-domain multi-agent systems, suggesting the OAuth-doesn't-fit argument is becoming a shared premise rather than a contested one. The open question the paper doesn't fully resolve is who issues and revokes these behavioral-scope credentials at runtime, and how fast that revocation propagates through a delegation chain before damage is done.