The trick is to treat this like an untrusted employee. Give it all it's own accounts, it's own spendable credit card that you approve/don't, VLAN your mini from your net. Delegate tasks to it, and let it rip. Pretty fun so far. I also added intrusion detection on my other VLAN to see if it ever manages to break containment lol.

Works for me as a kind of augmented Siri, reminds me of MisterHouse: https://misterhouse.sourceforge.net

But now with real life STAKES!