If we want to install some software on macOS such as ZeroTier One for example, it fails because it needs sudo and a password to install using homebrew.

Atera should create a service account on macOS with administrator permissions that it can use to call sudo and install software from Homebrew as required.

I would expect the password is kept atera side, is unique per device and is only delivered to the device with the script that does the software install, otherwise attacker may exploit this. Probably Atera would keep an encrypted version of the password server side, that encrypted password could be delivered to the AteraAgent on the mac and the AteraAgent could decrypt the password in memory locally for use with the script calling the homebrew install, and it clears it from memory once used.