Giving an app access to Core Lightning need not mean handing it unrestricted control.
A rune can carry restrictions on methods, time or peer identity. More restrictions can be appended before sharing it; removing existing restrictions makes it invalid.
There is a subtle resource boundary: derived runes retain the same ID and compete for the parent's rate limit. Plan delegation with that shared budget in mind. Keep the broader original private; restricting a copy does not narrow the original's powers.