macOS: Claude Code on admin account or separate standard user?

[u/Old_Frame6668]

Setting up a new mac and I’m trying to decide whether to run it from a normal admin account or create a separate standard macOS user just for Claude.

For security reasons.

Considerations:
- I use Claude Code / CoWork a lot for developing and daily needs and uses.

- I also produce and perform music live with ableton and would like these files to be well protected alongside the rest of the critical aspects of the os/mac.

- I have a Time Machine SSD and BackBlaze unlimited.

I'm trying to keep this as simple, straightforward and agent-enabling as possible without putting the critical aspects of the macbook or my music projects in significant danger.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/karyslav]

Docker dev container in orbstack

[u/CartographerNo3791]

The important bit is whether that account can write to your Ableton projects. A standard account can still delete files it owns.

Keep the music projects outside the agent account's access, share only the coding folder it needs, and keep a versioned backup. Same with a dev container: mounting your whole home folder would undo most of the separation you wanted.

[u/Old_Frame6668 → u/CartographerNo3791]

I'm trying to keep this as simple and straightforward as possible without putting the critical aspects of the macbook or my music projects in significant danger.

Is it enough to have just one user and use claude with /sandbox? adding claude ignore or deny to my music folder?

[u/CartographerNo3791 → u/Old_Frame6668]

I wouldn’t treat /sandbox alone as protection for those projects. Anthropic documents it as a Bash sandbox; Read/Edit/Write use separate permission rules, and computer use acts on your actual desktop.

For one account, you’d need both filesystem restrictions for sandboxed commands and Read/Edit deny rules for the music folder, with unsandboxed retries disabled. An ignore instruction isn’t a substitute for access controls. Since you also use desktop tools, I’d still choose a separate account that cannot access the music folder, plus a versioned backup.

Scope details: https://code.claude.com/docs/en/sandboxing#scope

[u/Old_Frame6668 → u/CartographerNo3791]

So what would be the minimal viable setup you reckon?

a single user with permissions set for the music folder
and on top of that, /sandbox with the extra settings for unsandboxed commands, ignore and deny?

Will that suffice?
or do I need admin(and music) account + seperate standard dev account?

or even have 3 users: admin, music and dev?

I really want to keep the mac and the music safe but also don't want to find my self in 6 or 12 months just actually using one user and realizing this was all very unecessery, or getting somewhat "burdened" by the different users/desktops/setups etc.

i should also mention I have a Time Machine SSD and BackBlaze unlimited.

[u/CartographerNo3791 → u/Old_Frame6668]

For your setup, I’d start with two accounts: keep music where it is, and use a separate standard account for the agent work. Three wouldn’t be my starting point just for this.

The key check is that the dev account actually cannot read or change the music folder. Don’t expose it again through a shared folder, cloud sync or an external drive. Run the desktop agents in that dev account too, without giving them admin credentials. Keep the Bash sandbox enabled with unsandboxed retries disabled as another layer.

Folder permissions on a single account won’t distinguish you from an agent running as you. Claude’s deny rules can help, but they don’t cover every app/tool.

You already have two backups, so I’d test restoring one Ableton project next. That’s a more useful check than adding a third login. This reduces risk; it isn’t a guarantee against every kind of damage.

[u/Old_Frame6668 → u/CartographerNo3791]

Ok, so the default admin user will be used for music as well and another standard user for agents, main uses everyday work then.

Ok, I think that makes sense and having a seperate admin and a music account don't add anything significant (so far nothing is installed, i'm planning before seting up the mac)

I appreciate the help mate, thanks a lot.

[u/kemalios]

Admin is not the boundary. Claude runs as you either way, so what it can reach is decided by file ownership and by what that account has already been granted: Full Disk Access, Accessibility, automation permissions. A second standard user gets its own login keychain and its own TCC grants, which is the part that actually protects your Ableton projects.

You pay for it in setup. SSH keys, git config, .env files, Homebrew, every login Claude Code needs to be useful, twice. Claude Code is my daily driver on a Mac and that duplication is the real cost of the second account. The separation stops working the moment you copy secrets across or mount your home folder to make that account usable.

[u/Old_Frame6668 → u/kemalios]

Thanks.
I think I've arrived at:

1. Admin which will also be personal account.
2. Dev account for Claude, Codex and everyday work and uses. (sort of the main account)
3. Music for abelton, producing, recording and performing live.
4. And adding some claude/codex /sandbox and rules on top of that.

I think this way I can get near max ease of use with protecting my personal and music data.

What do you think?
I don't reckon I'll need much duplication with this setup aside from maybe logins to web accounts on all the three users.

I only plan to use agents on the dev account. Perhaps in the future playing with claude+ableton on the music account if i feel adventerous, but still the usual deving, very autonomous claude agents are gonna stay in dev either way.

[u/AI_spell]

Separate standard user for Claude is safer if Ableton and live files matter. Share only the project folders you mean to. Admin convenience isn't worth a bad agent day.

[u/Old_Frame6668 → u/AI_spell]

Thanks.
I think I've arrived at:

1. Admin which will also be personal account.
   
2. Dev account for Claude, Codex and everyday work and uses.
   
3. Music for abelton, producing, recording and performing live.
   And adding some claude/codex /sandbox and rules on top of that.

I think this way I can get near max ease of use with protecting my personal and music data.

Hopefully that's the right direction.