Your fingerprint is the human in the loop

The problem with agents and privileges

An agent that writes code also wants to run the tests, restart the daemon, push the branch and read the deploy key. Today the choices are bad: give it passwordless sudo and a long-lived SSH key and hope; have it stop for a password every two minutes; or sandbox it so hard it cannot finish the job. Agents do not have fingers, which turns out to be the useful part.

The wrap

imk run --agent -- sudo systemctl restart api
imk run --agent -- git push origin main
imk run --agent --env-file .env -- python deploy.py

When the agent runs a command through imk run --agent --, the immurok app puts an overlay on your screen with the verbatim command, no summary and no paraphrase. Touch the key and the subprocess runs. Close the overlay, or let 30 seconds pass, and the subprocess is sent SIGTERM and the wrap exits with code 77, which the agent reads as “the user said no” and does not retry.

One touch covers the whole subprocess. Inside it, sudo finds an active five-minute pre-authorization and skips its prompt, SSH signing and secret reads are satisfied by the same touch, and a git push followed by an authenticated curl both work without a second overlay. The moment you dismiss the overlay the pre-authorization drops and the subprocess dies mid-flight, so there is no half-applied state.

Secrets the agent never sees

# .env
OPENAI_KEY=imk://api/openai
GITHUB_TOKEN=imk://api/github

Store API keys on the device and put imk:// URIs in .env instead of the values. imk run --agent --env-file .env -- ... resolves them after your touch and injects the real values into the child process's environment at exec() time. The agent, the parent shell and the agent's transcript only ever see the URI. The overlay bolds every imk:// URI in the command so you always know which keys are being read.

Why hardware, and not a password prompt

• One approval, brokered. A software password prompt belongs to the process that raised it. The immurok app sees sudo, SSH and secret reads together, so one touch can cover all three and one dismissal can cancel all three.
• Every approval is physical. There is no unattended mode. Walk away from the desk and the agent cannot push, cannot sudo, cannot read a key.
• No fatigue. The agent is not interrupted at every privilege boundary and you are not asked to rubber-stamp a dozen prompts. One command in the overlay, one touch.

Drop it into your agent

The imk-skill repository is a single Markdown skill that teaches an agent when to wrap a command, when not to, and how to exit cleanly when refused.

Agent	How to install
Claude Code	/plugin marketplace add immurok/imk-skill then /plugin install imk-tools@imk
Cursor, Cline, Continue, Windsurf	Vendor the skill into .cursorrules, .clinerules or .continue/rules.md
Codex, Aider, Gemini CLI	Append it to AGENTS.md, CONVENTIONS.md or GEMINI.md

Once loaded, the agent recognises the triggers (imk on $PATH, an ~/.immurok/ directory, imk:// URIs in .env) and starts wrapping privileged commands on its own. The full design is in A fingerprint gate for your AI coding agent.

Common questions