Why do API keys fall short for AI agent governance?

API keys can identify access to an API, but they often do not express workload identity, fine-grained policy, execution context, or agent-to-tool lineage. Production agents need stronger identity and audit controls, especially when they act across internal systems.