I have applied this at our company using Secretive, and extended to sudo over SSH: The remote end uses an SSH Agent PAM module that forwards sudo requests to the connected SSH Agent, which is Secretive running on the employee Macs, so we get remote sudo with TouchID prompts.

No more passwords to enter anywhere, and whatever an (AI) agent or malware is trying to do will require a human interaction at least, and not work when the screen is locked. The public keys authorized for this are distributed to the fleet via puppet, so we get control over who gets to sudo permissions and can easily provision or decommission machines.

Pretty stoked about it so far.