I think you are misunderstanding the use of wireguard here - this is a userspace wireguard connection, so the process has the same permissions as the user executing it.

In one sense, this is no different than adding a public key to ~/ssh/authorized_keys.

If you control the key, you control the authentication.