I went with the approach of giving it its own Google account, so that it can create docs and calendar events and then add me, rather than getting access to my Google account.

I wonder though: if Google can link this account to you as its actual owner, I wonder if there’s a risk if the bot does something against the ToS?

I hope you have backups of your Google account…