auth has an amnesia problem
jun 2026
the industry keeps solving the same problem and forgetting it solved it before. every few years, we reinvent authentication with a new name, new acronym, new deployment context. but underneath? it's the same idea we had in the 1980s.
kerberos invented the ticket
kerberos came out of MIT in 1988. the core idea: a trusted third party issues you a ticket. you show that ticket to services. they trust the ticket because they trust who issued it. simple, elegant, solved.
SAML: tickets for the web
fast forward to 2005. the web needs authentication. we get SAML. what is it? a ticket. issued by an identity provider. you show it to service providers. they trust it because they trust the issuer.
same concept. different XML format. different deployment model (HTTP instead of network protocols). but the idea didn't change.
OAuth: tickets for APIs
2010s. mobile apps and APIs everywhere. SAML is too heavy. we build OAuth. what is it? a token (read: ticket). issued by an authorization server. you show it to resource servers. they trust it because they trust the issuer.
same concept. different format (JSON instead of XML). different deployment context (REST APIs instead of web SSO). but the idea didn't change.
JWT: tickets you can read
OAuth tokens are opaque. services need to validate them by calling back to the issuer. that's slow. so we build JWTs—self-contained tickets. you can verify them locally with a signature.
same concept. now with stateless validation. but still: a trusted third party issues you a ticket, you show it around.
zero trust: tickets with extra paranoia
2020s. "don't trust the network" becomes a thing. we build zero trust architectures. what's the auth mechanism? tokens (tickets) that assert identity and context, issued by trusted identity providers, validated by every service.
same concept. now with more validation points, shorter-lived tickets, and better logging. but the idea didn't change.
we're about to do it again
AI agents are coming. they need to act on your behalf across services. we're building agent auth right now. and what will it be? tickets. issued by trusted agent coordinators. validated by services.
we'll call it something new. AgentAuth, maybe. XAA (Extended Autonomous Authorization). but it's the same idea kerberos had in 1988. a ticket, with a different name, for a different client shape.
why we keep forgetting
each generation of engineers solves the auth problem for their deployment context. web developers in 2005 didn't care about kerberos for mainframes. mobile developers in 2015 didn't care about SAML for enterprise portals. AI engineers in 2026 don't care about OAuth for REST APIs.
the deployment context changes. the shape of clients changes. the protocols change. but the underlying idea—trusted third party, issued ticket, validated everywhere—stays the same.
we're not making progress. we're rediscovering.