[quesera]

I find it useful to think of ssh as an encrypted transport layer that only usually runs a shell on the other side.

You can lock down ssh remote commands, and of course require proxied connections. You can include full auditing of command execution.