Giving my Grok Bot assistant admin rights without switching off UAC
SSH to localhost would have given dr eggbot, one of my Grok Bot assistants, silent admin over everything. Instead it gets a fixed menu of five elevated scheduled tasks it can start but not change, and I tested that boundary from the account it actually runs as.