How can I give a standard macOS account admin-like privileges while restricting system reset and specific app access on the latest macOS?

I’m using the latest macOS (Sonoma, as of December 2024), and I’ve set up a standard account for myself while a trusted friend holds the admin account credentials. I want my standard account to have the ability to: - Install macOS updates (e.g., security patches, new macOS versions). - Update apps downloaded from the Mac App Store and external sources. - Manage DNS settings, profiles, and perform general system tasks. However, I also need to restrict the following capabilities: - Factory resetting or erasing the Mac. - Access to specific apps (e.g., Apple Configurator or System Preferences). I’ve considered: - Using sudo to grant specific permissions to the standard account. - Locking sensitive settings and apps with profiles or Screen Time. - Automatic updates for macOS and apps. What’s the best way to configure the standard account to have admin-like privileges for updates and general system management, but still prevent it from resetting the Mac or accessing restricted apps?