diff --git a/repos/gems/run/decorator.run b/repos/gems/run/decorator.run
index 638675bbd..90b3eb903 100644
--- a/repos/gems/run/decorator.run
+++ b/repos/gems/run/decorator.run
@@ -61,6 +61,8 @@ append config {
 		<provides><service name="Nitpicker"/></provides>
 		<config>
 			<report pointer="yes" />
+			<domain name="" layer="2" />
+			<policy label="" domain=""/>
 			<global-key name="KEY_SCROLLLOCK" operation="xray" />
 			<global-key name="KEY_SYSRQ"      operation="kill" />
 			<global-key name="KEY_PRINT"      operation="kill" />
diff --git a/repos/gems/run/decorator_stress.run b/repos/gems/run/decorator_stress.run
index 78d3d9d72..2998690b2 100644
--- a/repos/gems/run/decorator_stress.run
+++ b/repos/gems/run/decorator_stress.run
@@ -120,12 +120,9 @@ append config {
 		<resource name="RAM" quantum="1M"/>
 		<provides><service name="Nitpicker"/></provides>
 		<config>
+			<domain name="" layer="2" />
+			<policy label="" domain=""/>
 			<report pointer="yes" />
-			<global-key name="KEY_SCROLLLOCK" operation="xray" />
-			<global-key name="KEY_SYSRQ"      operation="kill" />
-			<global-key name="KEY_PRINT"      operation="kill" />
-			<global-key name="KEY_F11"        operation="kill" />
-			<global-key name="KEY_F12"        operation="xray" />
 		</config>
 	</start>
 	<start name="report_rom">
diff --git a/repos/gems/run/terminal_log.run b/repos/gems/run/terminal_log.run
index 794b6424d..7a84f7919 100644
--- a/repos/gems/run/terminal_log.run
+++ b/repos/gems/run/terminal_log.run
@@ -16,6 +16,7 @@ build {
 	server/terminal_log
 	test/nitpicker
 	app/launchpad
+	app/pointer
 }
 create_boot_directory
 
@@ -58,6 +59,12 @@ append_if [have_spec sdl] config {
 	<start name="nitpicker">
 		<resource name="RAM" quantum="1M"/>
 		<provides><service name="Nitpicker"/></provides>
+		<config>
+			<domain name="pointer" layer="1" xray="no" origin="pointer" />
+			<domain name=""        layer="2" />
+			<policy label="pointer" domain="pointer"/>
+			<policy label=""        domain=""/>
+		</config>
 		<route>
 			<service name="Input">       <child name="fb_sdl"/> </service>
 			<service name="Framebuffer"> <child name="fb_sdl"/> </service>
@@ -88,6 +95,12 @@ append_if [expr ! [have_spec sdl]] config {
 	<start name="nitpicker">
 		<resource name="RAM" quantum="1M"/>
 		<provides><service name="Nitpicker"/></provides>
+		<config>
+			<domain name="pointer" layer="1" xray="no" origin="pointer" />
+			<domain name=""        layer="2" />
+			<policy label="pointer" domain="pointer"/>
+			<policy label=""        domain=""/>
+		</config>
 		<route>
 			<service name="Input">       <child name="input_drv"/> </service>
 			<service name="Framebuffer"> <child name="fb_drv"/> </service>
@@ -96,6 +109,9 @@ append_if [expr ! [have_spec sdl]] config {
 	</start>}
 
 append config {
+	<start name="pointer">
+		<resource name="RAM" quantum="1M"/>
+	</start>
 	<start name="terminal_fb">
 		<binary name="nit_fb"/>
 		<resource name="RAM" quantum="4M"/>
@@ -137,6 +153,7 @@ set boot_modules {
 	core init
 	timer
 	nitpicker
+	pointer
 	launchpad
 	testnit
 	nit_fb
diff --git a/repos/libports/run/eglgears.run b/repos/libports/run/eglgears.run
index 62d6d5e0c..0ba3c3621 100644
--- a/repos/libports/run/eglgears.run
+++ b/repos/libports/run/eglgears.run
@@ -2,7 +2,7 @@ build {
 	core init
 	drivers/timer
 	server/nitpicker server/nit_fb
-	app/launchpad
+	app/launchpad app/pointer
 	app/eglgears
 	drivers/framebuffer drivers/pci drivers/input
 	lib/gallium
@@ -65,8 +65,17 @@ append config {
 	<start name="nitpicker">
 		<resource name="RAM" quantum="1M"/>
 		<provides><service name="Nitpicker"/></provides>
+		<config>
+			<domain name="pointer" layer="1" xray="no" origin="pointer" />
+			<domain name=""        layer="2" />
+			<policy label="pointer" domain="pointer"/>
+			<policy label=""        domain=""/>
+		</config>
 		<route><any-service><parent/><any-child/></any-service></route>
 	</start>
+	<start name="pointer">
+		<resource name="RAM" quantum="1M"/>
+	</start>
 	<start name="launchpad">
 		<resource name="RAM" quantum="1G"/>
 		<config>
@@ -114,7 +123,7 @@ install_config $config
 
 set boot_modules {
 	core init ld.lib.so timer nitpicker nit_fb
-	launchpad eglgears
+	launchpad eglgears pointer
 	gallium.lib.so libc.lib.so libm.lib.so pthread.lib.so
 }
 
diff --git a/repos/os/run/loader.run b/repos/os/run/loader.run
index 31d8687d4..eb4daaa30 100644
--- a/repos/os/run/loader.run
+++ b/repos/os/run/loader.run
@@ -72,6 +72,9 @@ append config {
 	<start name="nitpicker">
 		<resource name="RAM" quantum="1M"/>
 		<provides><service name="Nitpicker"/></provides>
+		<config>
+			<domain name="" layer="2" /> <policy label="" domain=""/>
+		</config>
 	</start>
 	<start name="loader">
 		<resource name="RAM" quantum="1M"/>
diff --git a/repos/ports/run/debug_nitpicker.run b/repos/ports/run/debug_nitpicker.run
index a6b61db09..39bdc57fc 100644
--- a/repos/ports/run/debug_nitpicker.run
+++ b/repos/ports/run/debug_nitpicker.run
@@ -21,7 +21,7 @@ build {
 	drivers/timer drivers/uart
 	app/gdb_monitor
 	test/gdb_monitor
-	server/nitpicker app/scout
+	server/nitpicker app/pointer app/scout
 	drivers/framebuffer drivers/pci drivers/input
 }
 
@@ -64,13 +64,23 @@ set config {
 		<resource name="RAM" quantum="10M"/>
 		<provides><service name="Nitpicker"/></provides>
 		<config>
-			<target name="nitpicker"/>
+			<target name="nitpicker">
+				<config>
+					<domain name="pointer" layer="1" xray="no" origin="pointer" />
+					<domain name=""        layer="3" />
+					<policy label="pointer" domain="pointer"/>
+					<policy label=""        domain=""/>
+				</config>
+			</target>
 			<preserve name="RAM" quantum="2M"/>
 			<libc stdout="/dev/log" stderr="/dev/log">
 				<vfs> <dir name="dev"> <log/> </dir> </vfs>
 			</libc>
 		</config>
 	</start>
+	<start name="pointer">
+		<resource name="RAM" quantum="1M"/>
+	</start>
 	<start name="scout">
 		<resource name="RAM" quantum="32M"/>
 	</start>}
@@ -109,7 +119,7 @@ set boot_modules {
 	ld.lib.so libc.lib.so libc_lock_pipe.lib.so libc_terminal.lib.so
 	uart_drv
 	gdb_monitor
-	nitpicker scout
+	nitpicker pointer scout
 }
 
 # platform-specific modules
diff --git a/repos/ports/run/noux_terminal_fs.run b/repos/ports/run/noux_terminal_fs.run
index 394c750cb..984ab86cb 100644
--- a/repos/ports/run/noux_terminal_fs.run
+++ b/repos/ports/run/noux_terminal_fs.run
@@ -16,7 +16,7 @@
 set build_components {
 	core init drivers/timer noux lib/libc_noux
 	drivers/framebuffer drivers/pci drivers/input
-	server/terminal server/ram_fs server/nitpicker
+	server/terminal server/ram_fs server/nitpicker app/pointer
 	server/nit_fb
 }
 
@@ -90,6 +90,12 @@ append config {
 	<start name="nitpicker">
 		<resource name="RAM" quantum="1M"/>
 		<provides><service name="Nitpicker"/></provides>
+		<config>
+			<domain name="pointer" layer="1" xray="no" origin="pointer" />
+			<domain name=""        layer="2" />
+			<policy label="pointer" domain="pointer"/>
+			<policy label=""        domain=""/>
+		</config>
 		<route> }
 append_if [have_spec ps2] config {
 			<service name="Input"><child name="ps2_drv"/></service> }
@@ -98,6 +104,9 @@ append config {
 			<any-service><parent/><any-child/></any-service>
 		</route>
 	</start>
+	<start name="pointer">
+		<resource name="RAM" quantum="1M"/>
+	</start>
 	<start name="terminal_noux_fb">
 		<binary name="nit_fb"/>
 		<resource name="RAM" quantum="2M"/>
@@ -186,7 +195,7 @@ install_config $config
 
 # generic modules
 set boot_modules {
-	core init timer ld.lib.so noux terminal ram_fs nitpicker nit_fb
+	core init timer ld.lib.so noux terminal ram_fs nitpicker nit_fb pointer
 	libc.lib.so libm.lib.so libc_noux.lib.so
 	bash.tar coreutils.tar
 }