The UX of AI agent auth feels almost identical to running everything on human creds. So why will ID-JAG, Transaction Tokens, and WIF still spread? I read it from the May 2026 IETF drafts and the primary sources for Anthropic WIF / Okta XAA / MCP, the Replit / EchoLeak / Moltbook incidents, and the adoption curves of MFA, short-lived AWS creds, and Sigstore.