keychain security in a managed device (AD)
When you have to install a custom-made OS and software, there's really nothing you can do. It is completely like giving away root access. Shy of actually doing a full reverse engineering of the whole platform (not really feasible), you have to consider the risk that there's a built-in backdoor or automatic leaking of data to HQ.

Therefore the best would be to treat it as a non-private computer and not store any sensitive data on it that you wish to keep private from the company.