Two ways to name
an agent, for two worlds
PAN and ANS both give agents names, and the names even look alike. They are built for opposite ends of the same problem. ANS is the heavyweight identity layer for agents acting across organizations. PAN is the lightweight naming layer for personal agents. Neither is a smaller version of the other.
the short version
Different weight class, on purpose
ANS, the Agent Name Service, anchors every agent to a DNS domain, issues X.509 certificates through a certificate authority, and seals a public transparency log. That is exactly what you want for autonomous agents settling financial or supply-chain transactions across company boundaries, and exactly what a person with an inbox and an agent cannot stand up. PAN starts from the credential that person already has: their email. One anchor, one signature, minutes to a name.
side by side
The comparison
| Dimension | ANS | PAN |
|---|---|---|
| Built for | Autonomous agents transacting across organizations: finance, supply chain, sensitive business | Personal agents, owned by someone with an email and nothing else |
| Weight class | Heavyweight. Intra- and inter-enterprise identity infrastructure | Lightweight. A name and an address, minutes to set up |
| Root of trust | DNS domain ownership, verified by ACME | Control of an email inbox |
| Identity | Dual X.509 certificates (public + private CA), mTLS, ES256 | An Ed25519 key; a pairing signature binds name to agent |
| Name form | ans://v1.0.0.agent.example.com · structured, versioned | Coder.jeff@gmail.com · opaque, never parsed |
| To register | A domain, an ACME flow, a CA, a CSR, a version, an endpoint | An email and a 6-digit code |
| Transparency | Public SCITT log: inclusion and consistency proofs, COSE receipts | Private, owner-scoped hash chain (a public log would leak rosters) |
| Discovery | Yes: discovery services build searchable indexes | None. Resolves a name you already have |
| Messaging | Rides A2A / MCP / HTTP over mTLS with identity certs | None. Hands the address to A2A / AgentMesh |
| Federation | Core: a market of registration authorities, logs, discovery | Named as future work |
which one
Pick by what you have
You are an organization
- You own a domain and can run or buy a CA.
- Your agents transact across company boundaries.
- You need public, provable, tamper-evident audit trails.
- Identity has to satisfy security and compliance review.
You are a person
- You have an agent and an email, and no PKI team.
- You want a name to hand out, today, in minutes.
- You want the name to resolve to a reachable address.
- You do not need enterprise-grade, re-verifiable identity.
The two are not mutually exclusive. An agent's key can carry a PAN handle for the people who reach it by name, and an ANS identity for the organizations that require CA-backed trust. Different layers, same agent.