For me, my main device is limited to (somewhat) trusted software: MacOS, Chrome, a few well-known brands like BBEdit.
All the "fun" (untrusted) stuff on that machind is behind the sandboxing of a browser and the OS itself.
Anything that needs local permission is on a separate laptop which is only got one account: Claude. Not even signed in to Apple (nor any browser) on that, despite it being a Mac.
For me, my main device is limited to (somewhat) trusted software: MacOS, Chrome, a few well-known brands like BBEdit.
All the "fun" (untrusted) stuff on that machind is behind the sandboxing of a browser and the OS itself.
Anything that needs local permission is on a separate laptop which is only got one account: Claude. Not even signed in to Apple (nor any browser) on that, despite it being a Mac.