01
Execution is becoming decision.
For fifty years a program was a full specification of behavior. An agent is not. It chooses which tool, in which order, whether to retry, when to stop. The code no longer tells you what the system will do.
SuchWays Labs / Independent Research LabStudy → Build → Release
Autonomy is aninfrastructure problem.
Software is starting to choose its own actions. The systems it runs against were never built for that. SuchWays Labs studies what breaks — identity, context, policy, control — and builds the layer that has to exist before an agent can be trusted with anything real.
PROGRAM / GOVERNED ACTION
STATUS / ACTIVE
EST / 2026
STATUS / ACTIVE
EST / 2026
Field / 01State / Dynamic
Study → Build → ReleaseScroll to enter ↓
00 / The lab
Most software follows established paths.
We are interested in the ones that haven’t been established yet.
SuchWays Labs is an independent research lab. We take one badly-understood infrastructure problem at a time, write it down until it is precise, build the smallest system that tests it against real tools and real permissions, and release what survives.
The current problem: letting autonomous software act on production systems without anyone losing the ability to say no.
01 / Thesis
Three things we think are true.
02
Permission is not judgment.
An access list answers whether a principal may call a tool. It cannot answer whether this call, now, produced by that instruction, is a reasonable thing to do. Everything we build lives in that gap.
03
Control has to travel with the action.
Identity, context, policy and the record of what happened can no longer sit at the perimeter. They have to move with every request, all the way to the system it touches, and come back with the result.
02 / Method
We research.We build.We ship.
Study
We start with problems that are still badly defined and work until we can state them in one sentence. Most of the field notes are that work, published while it’s still uncertain.
Build
Then the smallest system that tests the statement against real tools and real permissions. Prototypes are disposable. Most of them are thrown away; what they taught us isn’t.
Release
When a prototype keeps being useful after we’ve stopped working on it, it becomes a system with a name and a roadmap. IronWay is the first.
03 / Systems
System 001 / Active development
IronWay
A control plane for software that acts.
IronWay sits between an agent and everything it can reach — cloud, data, repositories, business systems — and answers five questions for every request before it touches anything: who is acting, on whose authority, with what context, under which policy, and what will be recorded.
Requests are approved, held for review, or blocked. The decision and its reasons are part of the record.
Talk to us about IronWay ↗System 001Illustration / Request flow
ApprovedReviewBlockedScroll sideways for the full flow →Requests → Context / Identity / Policy → Governed action
04 / Open problems
Questions we don’t have answers to yet.
All field notes ↗01
What is the unit of authorization when the caller is an agent?
The principal, the action, or the intent that produced it? Access control assumes the first. The failures we care about live in the other two.
Active · prototypeNote 003 — Software needs an immune system
02
How much context does an action need before it can be judged — and who is allowed to see it?
Task history, delegated authority, provenance, data sensitivity. Enough to decide; not so much that the boundaries disappear.
Active · writingNote 001 — Context is becoming infrastructure
03
Can a chain of delegated actions be made reversible without making it slow?
When software chooses what software to call, the graph is decided at runtime. Observability is the easy half. Undo is the hard one.
Vocabulary
How we use these words.
- Principal
- Whoever an action is attributed to — a person, a service, or an agent acting on delegated authority.
- Delegation
- Authority passed from one principal to another for a bounded purpose. The chain, not just the last link, matters.
- Provenance
- Where an instruction or a piece of context came from, and how it entered the decision.
- Policy
- What is allowed — evaluated at the moment of action, with the context available at that moment.
- Control plane
- The layer that sits between an agent and the systems it reaches, and decides per request.
- Governed action
- An action that was identified, contextualized, evaluated against policy, and recorded — before it ran.
05 / Position
We would rather be early and precise than late and general.
SuchWays / Contact
[email protected] ↗