A weekly audit that lists every script, scheduled job and credential on my machine, diffs them against a git baseline I approved, and emails me only when something changed that I did not change. Approving a change takes one commit, so a quiet week means the machine matches what I signed off.
Automation is a growing attack surface you built yourself. A scheduled job that quietly changes, a script with a new network call, a credential that appears in a config: each is invisible unless something looks for it.
The audit script inventories every persistence point on the machine (scheduled jobs, login items, shell hooks), every automation script and every credential reference, and writes the inventory to a git repository. The baseline is the last commit I approved. Each run diffs the live state against it and classifies changes. Informational changes go to the weekly report; a critical one, a new job or a script touching something it never touched before, triggers an email immediately.