This paper discusses mutation as a new way for making things, in the context of Internet-of-Things (IoT), active instead of being passive as reported in the ICT literature. IoT is gaining momentum among ICT practitioners who see a lot of benefits in using things to support users have access to and control over their surroundings. However, things are still confined into the limited role of data suppliers. The approach proposed in this paper advocates for 2 types of mutation, active and passive, along with a set of policies that either back or deny mutation based on specific “stopovers” referred to as permission, prohibition, dispensation, and obligation. A testbed and a set of experiments demonstrating the technical feasibility of the mutation approach, are also presented in the paper. The testbed uses NodeMCU firmware and Lua script interpreter.