Agent Name Service (ANS)

My company's payment agent receives an instruction to wire $50,000 to a supplier's
invoicing agent. The payment agent must decide: does this agent actually belong to
the supplier, or has someone stood up a convincing fake? And if the site is
legitimate, has the supplier's code changed since my last transaction?

ANS answers both questions. It anchors every agent's identity to a domain name
whose ownership has been verified, issues a version-bound certificate that records
which code is running, and seals every lifecycle event into a Transparency Log
where entries cannot be altered after the fact. The standard is open and the
services are federated, but the identity always anchors to a domain name.

Specifications

The ANS protocol is split across seven layered specifications under spec/:

Worked examples for ANS-1 live at spec/examples/ans-1-examples.md. DESIGN.md is a pointer to the layered specs and to the IETF draft.

MAESTRO.md — Security analysis. Applies the CSA
MAESTRO
threat modeling framework to the ANS architecture. Maps threats and mitigations
across all seven layers, from foundation models through the agent ecosystem,
using a concrete multi-agent travel-booking scenario.

Related

trust-index-spec —
Trust evaluation. How a Trust Index crawls sealed data from federated
Registration Authorities, combines it with external signals, and scores agents
across five dimensions: integrity, identity, solvency, behavior, and safety.
Trust Manifest schema, credential formats, identity grades, federation, and
security considerations. Maintained in its own repository; not an ANS protocol
layer.

A temporary TRUST_INDEX_SPEC.md copy is maintained here
while the existing PRs #46,
#47,
#48,
#49, and
#50 are reviewed and resolved.
Accepted changes will be incorporated into trust-index-spec before this local
copy is removed.

SENDER_VERIFICATION_SPEC.md — Per-sender
email verification. JWS header-only signing with key bindings sealed in a
SCITT transparency log, discoverable via DNS. Targets business email
compromise where domain-level authentication (DKIM/SPF/DMARC) passes but the
sender is not who they claim. Not an ANS protocol feature.

API

The OpenAPI contracts and conformance schemas live under api/:

• api/api-spec-v2.yaml — Registration Authority management API
• api/api-spec-tl-v2.yaml — Transparency Log API
• api/identity-event-schema-v2.json — sealed Verified-Identity event (V2)
• api/tl-response-schema-v2.json — Transparency Log entry (V2)

SDKs

• ans-sdk-rust
• ans-sdk-go
• ans-sdk-java

Origin

This architecture builds on "Agent Name Service for Secure AI Agent Discovery"
by Narajala, Huang, Habler, and Sheriff (OWASP), contributed to the IETF as
an internet-draft (draft-narajala-ans).

License

Apache 2.0. See LICENSE.