The Beer Drinker’s Guide to XAA - by Niall McLoughlin

SAML not camel

SubscribeSign in

The Beer Drinker’s Guide to XAA<br>With apologies, and thanks, to Greg Seador

Niall McLoughlin<br>Aug 01, 2026

Share

For about ten years now, whenever someone has asked me to explain single sign-on, I’ve quietly stolen a beer analogy that belongs to somebody else.

It’s Greg Seador’s. He wrote the Beer Drinker’s Guide to SAML for Duo, and if you’ve never read it, stop here and go and read that first, because it’s the best explanation of federated identity I’ve ever come across and everything below is standing on the shoulders of giants.<br>The trick to it is that it’s lazy, and good explanations always are. It doesn’t teach you SAML. It puts you at a festival and lets you work the rest out yourself.

I’ve used it in workshops, on the backs of napkins and in training sessions for a decade. So when the hardest thing I now have to explain to clients turned out to be agentic security, I turned to Greg’s beer analogy. It’s useful even if you’re a wine drinker or don’t touch the stuff.

The OG festival

Quick recap for anyone who skipped the homework. Bob wants a pint. He walks to the Wristband Tent, shows his ID, and gets a wristband. The Wristband Tent is the identity provider. The Beer Tent then serves him without checking anything except that wristband, because it trusts whoever runs the Wristband Tent to have done the hard part. The Beer Tent is the application. The wristband is the assertion. The Wristband tent is your identity provider. That’s single sign-on, and Greg gets all the credit for it for the incentive related walk through.

For ten years that was the whole story, because the only question anyone needed answering was a simple one. Is this person allowed in. Are they allowed a pint.

The festival changed

Then Bob stopped queuing.

These days Bob doesn’t walk to the Beer Tent, the Food Tent and the Merch Tent himself. He sends a runner. Not a person, a robot: a tireless machine that can be in three queues at once and never needs to watch the band. Bob stays exactly where he is, pint in hand, while his robot whizzes off to fetch the next round. Bob can be asleep. The robot is an AI agent, and the festival is slowly rebuilding itself around the fact that most of the fetching is now done by machines.

The tents changed first. You can’t have a human behind the bar reading handwritten notes from a hundred different robots, so every tent has fitted a service hatch with a standard printed menu. Any robot from any firm can roll up, read the menu, and order the same way. That hatch is an MCP server, and it’s why they matter. A hatch that says MCP above it is the reason a robot built by one company can order from a tent built by another without a bespoke integration for every pairing. It’s the festival agreeing on one way to take an order. This is standards, baby and it’s how things get done around here.

Notice what the hatch doesn’t have. A bouncer. The hatch is fast and standard and completely indiscriminate. It will serve anyone who rolls up and orders correctly. Speed and standardisation on their own are an open bar which is precisely why you need everything that follows. Not all open bars are good.<br>Everyone looked like Bob

This is the bit almost nobody explains. Until very recently the robot had no identity of its own so it did the only thing it could. It wore Bob’s face. It borrowed Bob’s wristband and walked up to every tent as Bob, and the tents had no way to tell the difference. The tents are dumb. As far as the Beer Tent was concerned, Bob himself had strolled up to the counter. Every tent on the site was certain it had met Bob, though Bob hadn’t moved an inch from the front of the stage.

Two nasty things fall out of that. The first is power. If the robot is indistinguishable from Bob, it can do everything Bob can do nothing to stop it ordering tequila all night on his tab, or if there’s a Ferrari tent at the festival it can get one of those too, and do a Ferris Bueller. The second is blame. When someone finally asks who drank the festival dry, every receipt and barman swears it was Bob, because Bob’s face is the only thing they ever saw. You can’t tell the man from the machine wearing his face, and the machine is walking around with every ounce of his authority.<br>This is the world before XAA ( or id-jag ) and it’s roughly where most agent deployments sit today.

The festival hands the robots their own lanyards

The fix is to stop letting robots borrow faces, and start giving them their own.

The festival now issues every robot a lanyard of its own. A robot turns up as itself, a recognised machine, badged plainly as one of Bob’s delegates. Like a name badge at a conference with your name and company logo on it.<br>The moment it does, a tent knows two things it could never establish before: that this is a robot rather than a person, and that it’s running for Bob rather than pretending to be Bob.<br>Delegation out in...