That’s the same reason I started using the Secure Enclave SSH access for HomeAssistant: I wanted to grant agentic access, but I also didn’t want my house’s automations being blown up. Everything is written offline as IaC, and gets pushed with explicit approval only.