I give it passwordless sudo but don't give it permissions to automatically run commands. I just review what it's running before accepting. If it looks questiona

I give it passwordless sudo but don't give it permissions to automatically run commands. I just review what it's running before accepting. If it looks questionable, I interrupt and ask it to explain what/why it wants to run the thing