Mint and spawn

Registering an agent goes through the same policy engine as any other write. Tool id: kya.agent.register.

Human mint

A person using the console, CLI, or REST with no parent agent follows the workspace human mint mode (owner/admin sets this on /app/kya/policy):

• Allow + trail (default): the agent is created now. AGENT_REGISTERED is always written.
• Break-glass: type a reason. Same trail. No second approver.
• Require approve: even a human mint waits in Approvals.

Agent spawn

When one agent creates another (parent set, or wrap/MCP kya.agent.register), evaluate always runs. Missing APPROVED means no child. Children count toward the named-agent census (25 / 250 / unlimited).

Presets: Solo (defaults), Regulated (break-glass + auto shrink), Lockdown (require approve on mint and on HIGH-risk shrink).

API: POST /api/v1/kya/agents. List children with ?parent=. Orphans (ACTIVE child, REVOKED parent): GET /api/v1/kya/agents/orphans (Pro+ on the price table).