The dashboard agent uses a restricted identity and specific local helpers for supported operations. It does not accept arbitrary shell commands from the backend.
You choose dashboard actions and configure any update schedule. Installation and privileged helpers are trusted software that can change the machine within their scope. Keep your provider console available for independent access.