Great question—you’re totally right to notice the similarities between these two roles, but they serve distinct, complementary purposes in the Hyperledger Indy ecosystem. Let me break down their core differences and how they interact:

Core Roles & Main Responsibilities #

• Trust Anchor: Think of this as the network’s "identity gatekeeper." Their primary job is to onboard new entities (individuals, organizations, or even other roles) by verifying their real-world identity and writing their DID (Decentralized Identifier) and Verkey to the ledger. Trust Anchors are typically established during network setup, and they’re the foundation of trust—without them, new entities can’t join the network in a verified way. They’re focused on initial identity validation and entry.
• ENDORSER: This role is all about upholding ledger integrity. ENDORSERS don’t handle onboarding directly; instead, they validate and sign off on state-changing transactions (like creating schemas, credential definitions, or updating DID attributes) before those transactions are written to the ledger. Any entity wanting to submit these types of transactions needs an ENDORSER’s approval first. ENDORSER permissions can be granted to any trusted entity in the network, not just Trust Anchors.

Permissions & Scope #

• Trust Anchors hold onboarding-specific permissions: they can create DIDs for new entities and assign them roles (including ENDORSER). Their scope is limited to identity initialization and granting network access.
• ENDORSERS hold transaction-endorsement permissions: they can authorize ledger-modifying transactions, but they can’t onboard new entities unless they also have Trust Anchor privileges. Their scope is centered around ensuring only legitimate changes are made to the ledger.

Overlap & Real-World Use Cases #

• It’s common for a Trust Anchor to also have ENDORSER permissions. For example, a bank acting as a Trust Anchor might onboard a small business, then act as the ENDORSER for that business’s requests to create payment-related credential definitions.
• However, an ENDORSER doesn’t need to be a Trust Anchor. A city government could be an ENDORSER to approve credential definitions for public services (like building permits) without handling the initial onboarding of residents or businesses.

内容的提问来源于stack exchange，提问作者MiryangJung