How do AI agents identify themselves when consuming APIs? Agents are acting on behalf of people, so can they potentially use OAuth 2? Or something else? What about AI agents that act on behalf of other agents? Do we need a different authorization framework?