Agent identity is just OAuth in a fake mustache. I suspect the real boundary is not agent-to-agent, but context + permissions + audit trail.