A new paper proposes tying agent accountability directly to the binary running the agent, not just the key it presents. The framework, called BAID (Binding Agent ID), argues that current key-based authentication for AI agents cannot actually guarantee who's operating an agent or whether its code has been tampered with — it only proves someone has a private key, which says nothing about the human behind it or the software actually executing. The paper frames this as a forced choice: agent systems either stay "downgraded tools" with heavy human oversight, or they run more autonomously and accept real-world abuse risk, because there's no traceable accountability mechanism connecting an agent's actions back to a responsible operator and a verified codebase. BAID tries to close that gap with three layered mechanisms: local biometric binding of a human operator to a device, decentralized on-chain identity management, and what the authors call a zkVM-based Code-Level Authentication protocol. The zkVM piece is the more novel claim. Instead of treating an agent's identity as just a cryptographic key, the protocol treats the program binary itself as the identity, using recursive zero-knowledge proofs to attest to that binary's integrity across its execution. The stated goal is cryptographic guarantees spanning three things at once: who authorized the agent (operator identity), what code it's actually running (configuration integrity), and a full record of what it did (execution provenance) — closing off both unauthorized operation and quiet code substitution somewhere in the deployment pipeline. Notably, the paper's own related-work section takes aim at the current landscape of agent lifecycle standards, including OpenAPI-based agent management protocols, arguing they share a common blind spot: none of them provide a unified, trusted layer for agent registration and identity verification across different protocols, which is exactly the gap BAID is trying to fill. The authors report building and evaluating a working prototype, which matters because a lot of agent-identity proposals stop at architecture diagrams. Whether zkVM-based proof generation is fast enough for real-time agent execution — recursive proofs are not cheap — is the practical question the abstract doesn't answer, and it's the one that will determine if this stays academic or becomes something operators actually deploy. This sits squarely in the identity pillar: it's about binding a verifiable, tamper-evident identity to both the human operator and the code artifact, ahead of any attestation about individual actions.