Sandbox Coding Agents with a Separate User Account

I don't trust our new robot overlords at all. I also don't fully believe that agents are out there dropping production databases without some serious coercion to do so. And while I don't trust the robots, I trust myself only a trivial amount more, so my local access tends to be extremely thin. But not so thin that a rogue agent couldn't do a little damage. That all said, I am constantly calibrating my trust with agentic endeavors. In doing so, I've been moving agents out of my user space entirely. Having Claude Code and other harnesses living under a separate user account eliminates a lot of potential disasters due to the agent finding privileged local credentials that could do some damage. Sandboxing my agents has improved trust thanks to the isolation. It's also had an additional benefit of the robots not being thoroughly confused by some of my shell aliases. It's a clean slate, and I grant access, mostly read-only, accordingly. With my agents running primarily outside of my user…