# Why Ironwall stopped watching how people move

> Early Ironwall research told people from bots by how they move, and scored an AUC of 0.9982 on synthetic data. Grideōs set it aside for cryptographic attestation. This is why.

Source: https://grideos.com/dispatches/010-why-ironwall-stopped-watching-how-people-move
Publisher: Grideōs (Grideos Global Corp.), Calgary, Alberta, Canada
Updated: 2026-10-16

Dispatch 010. Published 2026-10-16. Updated 2026-10-16.

Before Ironwall used cryptography, it tried physics. Early research fused five behavioural signals to tell people from automated agents: the path of a pointer, the timing between actions, a phone's accelerometer, pointer metadata and the way a page is scrolled. A synthetic data generator produced labelled sessions for people and for three grades of bot.

## It worked on paper

On that synthetic data, the classifier reached an AUC of 0.9982 and passed 99.6 percent of simulated people. Those are Grideōs' own figures, on data Grideōs generated. They were never tested against real traffic, and that gap matters.

## Why we set it aside

- Motion can be imitated. The fine tremor of a human hand, around 8 to 12 Hz, can be injected as noise by capable automation. Watching behaviour raises the cost of pretending to be human; it does not remove it.
- Watching is a liability. Collecting behavioural telemetry continuously creates exposure under privacy laws such as PIPEDA and the GDPR, and the organizations Ironwall is built for would rightly refuse it.
- It excludes people. A system that judges how someone moves disadvantages people with motor impairments, which is an accessibility failure before it is a compliance risk.

## What replaced it

Ironwall now asks a different question: not whether a request moves like a person, but whether it is backed by real, attested hardware. The device's Secure Enclave or TPM signs a one-time challenge through WebAuthn, the biometric unlock stays on the device, and the result is compressed into a zero-knowledge proof that a verifier at the network edge checks in 8.6 ms. In that design the biometric check stays on the device and no motion data is collected. The edge check is live; the attestation and proving steps are published architecture. [How Ironwall works](https://grideos.com/ironwall/).

## Why publish a dead end

Because the reasons are the useful part. The research and its synthetic data generator remain public under the MIT licence at [kinematic-signal-research](https://github.com/GrideosGlobal/kinematic-signal-research), with what was never validated listed plainly. A verification company should show what it rejected and why, not only what it kept.