In theory, you could automate any UWP, WPF, Windows Forms or web application with UI-automation as far as I know, so the list is growing by the minute
you can also run DOS commands, VBscript, Javascript, Python, Powershell, Excel VBA Macros and SQL in the Power Automate Desktop runner.
I'm not sure how one would audit that; but you could probably restrict the usage with a group policy, and have a separate account with higher security clearance that runs the flows that needs to do so.