What three observations can be drawn from how IAM standards have developed over time?

• No standard is final: even widely used standards get replaced.
• Early versions are often unusable and are later replaced by improved versions.
• Very complex, comprehensive standards have not prevailed; lightweight ones are implemented more often.

Each observation is visible in the history of the standards themselves:

1. No standard is final. NTLM ran half the corporate world and is now deprecated; X.500 directories gave way to LDAP. Betting on "the" standard forever is a mistake, so architectures should be able to swap protocols.
2. Version 1 is rarely the one that sticks. SAML 1 and OAuth 1 were both quickly replaced by their second versions. Adopting a brand-new standard early means accepting that you may have to migrate again.
3. Lightweight beats comprehensive. X.500's DAP lost to the Lightweight Directory Access Protocol; the XML-heavy SPML never took off, while the simpler SCIM spread through the cloud; OAuth 2 won partly by dropping OAuth 1's complex signatures. A standard that developers cannot implement in a few days tends to stay on paper.

Tip: When judging a new standard, ask: is it simple enough that many vendors will actually implement it? Adoption, not completeness, decides whether a standard survives.

Go deeper:

• Worse is better (Wikipedia) — the classic argument for why simpler designs spread faster than complete ones.
• Second-system effect (Wikipedia) — why over-ambitious designs tend to fail.