Scoped account plus staging is the right answer, I do the same for the agents I build for client shops.
One thing I'd add on your end: start it read-only. The first weeks my agent only gets GET on the REST API and writes its proposed changes to a log, and a human clicks apply. Writes come later, when I have seen what it wants to do.
And I keep a written list of allowed actions. Update a price, yes. Delete a product, never!
That list goes straight into the client contract now - and the article is the reason why. If it does something outside the list that is on me, inside the list it is a shared problem, and at least it's written down somewhere.
Not tested in court, obviously.
