The tools above cover the everyday jobs. When your assistant needs to do something they don't, you can give it direct access to the Sodium API instead, with an API key limited to exactly the areas you choose.
Start with a custom role that allows only what the key should reach, area by area and capability by capability. Create the key against that role, and anything you connect with it, whether that's your own AI agent, a script or an integration, can work with that data and nothing else. It never runs as an unrestricted administrator.
See how custom roles work, or explore the Sodium API.