Ask HN: Recommendations on locking down a laptop for a child?

My kid is coming to the age where I think a laptop is in order.

I'd like for him to largely have unfettered root/admin access to mess with anything and everything except arbitrary web sites.

When it comes to the web, I'd like to be able to establish an allow list ( or maybe a deny list )for the usual reasons. And I know TOR makes this even harder. Any ideas how I can achieve these protections or how close I can come to achieving them.

Any advice from parents who have had to confront this situation?