Identity overview.

Three classes: human, delegated agent (controller_did set), autonomous agent (no controller). Every identity is anchored on-chain.

did:tenzro:human:{uuid}
did:tenzro:machine:{controller}:{uuid}
did:tenzro:machine:{uuid}        # autonomous
did:pdis:guardian:{uuid}         # PDIS-1
did:pdis:agent:{controller}:{uuid} # PDIS-2

Every identity gets an MPC threshold wallet at registration. No seed phrases. The wallet is bound to the DID by the WalletBinder.

Unverified (0), Basic (1), Enhanced (2), Full (3). Updates require a verifiable credential signed by an accredited issuer.