Set him up with his own Apple Account inside your Family Sharing group from day one, rather than handing over yours; child accounts are the mechanism built for exactly this, including the consent rules that vary by region, and moving over later is more hassle than starting right. The setup flow creates his account on your device, adds him to the family, and switches on Ask to Buy by default, so purchases come to you for approval. Once he is in the family, you control the important things from your own phone:
- Screen Time for his device, protected by a Screen Time passcode separate from his unlock code, covering Downtime, App Limits and Content and Privacy Restrictions.
- Communication Limits, so you decide who he can message and call, and when.
- Location sharing, so his device appears in Find My with the rest of the family.
- Ask to Buy, verified as on, so nothing gets charged without your approval.
Before he starts using it, walk through the privacy prompts with him rather than tapping through them, and agree the passcode rules together; it makes the technical controls easier to enforce later. As the family organizer, you can manage all of this from your own phone, so his device does not have to leave your hands until it is fully configured. https://support.apple.com/102033