What you need

Two paths reach the same result. One is networked and easy to place; the other is a cable and is faster. Both leave the target untouched.

The networked path

A KVM device sits between the target and its monitor, and runs the daemon. The agent host talks to it over the network with a bearer key. Nothing is installed on the target.

• A supported KVM board, connected to the target by USB for input and HDMI for video.
• A key, generated on the device. It never leaves it and never appears on a command line.
• A trusted network segment. The daemon has no transport encryption and no rate limiting, so the segment is doing real work.

Suited to a rack, a cupboard, or any machine that has to be reached from elsewhere.

The direct USB path

No network at all. The agent host is physically connected to the target: a capture card takes the target's HDMI, and a USB bridge presents a keyboard and mouse to it. Latency is lower and there is no listening port anywhere.

• An HDMI capture card on the agent host, taking the target's video output.
• A USB HID bridge into the target, bus-powered by it, so input appears exactly when the target's USB does, including at BIOS and UEFI.
• Physical access. That is the control on this path, in place of the key.

What the target sees

A USB keyboard and a USB mouse. No driver, no service, no agent. Its own logging is unchanged, and unplugging the cable ends the access. That is also why the target's account is the real boundary: keystrokes carry the authority of whoever is signed in.

Scope the account to the task before the first run. AMI cannot tell authorised work from unauthorised, and neither can the target.