Comment by ra

I agree. If an agent needs to assume an identity, it needs a human in the loop to authorise - browser oauth is convenient for this.

Agents are not identities, they need to be granted permission to accomplish tasks. The identity is the person that grants the permission.

If no identity is required then this is simple machine-machine API keys.