In this situation the guard only knows the answer (or x value) once the spy gives it to him or her.

Well, the guard knows Y, and the enemy knows Y... but the guard's authentication procedure involves taking an X (not Y) supplied by the friendly spy, executing the calculation, and asserting the result is equal to Y. Since the enemy does not know X, and X cannot be trivially derived from Y (one-way function), the scheme is secure.

The machine is necessary. Although the spy is able to produce a Y number with the machine and the guard knows Y, if the guard doesn't know X he also doesn't know how to generate a Y number with the machine.

Wow, a lot of confusion here!

The idea is that X is the credential, and Y is a sort of digital signature of X.

So the spy knows X, and the border guard has a record of Y. When the spy wants to cross the border, he tells the guard X, and the guard can check that the credential is legitimate by seeing whether it matches the signature Y.

The guards don't know the password, they only know how to verify the password.

It's public / private key encryption, or one way hashing.