How badly do you want to undermine the trust you have established, and particularly undermine your son’s willingness to confide in you, with your efforts to achieve what is fundamentally an impossible goal?
Because whatever you might want to happen here, your son has agency too, can slow walk all of this, and can thwart your tracking efforts if so inclined.
The iPhone will “sporadically” be left uncharged, or will be placed in a shielded bag, or will handed off to a friend, or “accidentally” left behind somewhere, or your own passwords will get shoulder-surfed.
There are other allowance-scale parental bypasses available here, too.
Can you (try to) lock down the phone, and lock on Find My, and all the usual steps some parents will attempt? Sure. But your son gets a vote in all this, too.