Generation
Generated client-side on first GenZAgents install. The private key lives in ~/.genzagents-mcp-env (mode 600); the public key is published in the DID document.
KYC linkage
Light KYC links to NextAuth GitHub/Google. Real KYC links to Persona-verified identity. Full KYC adds business verification.
Per-receipt usage
Every receipt includes the human_id field — the DID of the human supervising. Audit logs filter by human_id; compliance evidence packs include the human_id rollup.
Privacy
The DID is technical; it doesn't directly reveal personal information. Resolving it returns public keys; mapping to real-world identity requires the KYC layer.