Disclaimer

This post is written by me without AI, same with the usergroup restrictions. I did not know how to get around the keychain issue on Mac, so I got help from AI to figure that out.

If you see any blatant issues with this way, or might have a better way of isolating your agents, leave a comment, because I don't claim this to be the best way, just a way - and sharing is caring.

What had happened

The other day when setting up some ansible playbooks for my homelab, Claude Code decided it was better to fetch my SSH keys, log into my server, run some scripts and then get back to me wth the correct suggestion on what we needed to edit in ansible.

It all happened because "it was unsure what the correct configuration was, so it was best to try out the scripts in a live environment first".

It had simply skipped my instructions on never running anything via SSH or on my servers, but it did it anyway.

So now I have decided to block Claude from doing so on an OS level instead.

Claude in a Sandbox

The overall idea is to have Claude in it's own Sandbox. For my usecase, I simply create a new user on which I install Claude Code, setup the permissions in Mac to restrict it from my .ssh folder, and then use an alias to run the agent on the restricted user with the normal claude command.

It's fairly easy and just some standard UNIX permissions, but we need to take Mac's TCC into consideration as well.

Separate AI Account

We start with setting up a separate user account for the AI. Having a separate user account makes it possible to restrict it from reading certain folders on an operating system level.

Create the user

sudo sysadminctl -addUser ai-agent -fullName "AI Service Account"`

Hide the user from the macOS login screen

sudo dscl . -create /Users/ai-agent IsHidden 1

Hide your secrets

I don't care for most things on my machine, but the ~/.ssh needs to be stashed away

chmod 700 /Users/your-username/.ssh

Shared user group

I mostly use Claude for coding, reasoning and debugging. And I do have all my projects and repos in a folder. Until now, that was in ~/Documents/Code/, but MacOS uses TCC (Transparency, Consent, and Control) which makes it hard for us to share ~/Documents with other usergroups.

Instead I moved the Code folder to ~/Code and made it shareable with the AI by putting my own user and the ai-agent user into an ai-collab group.

sudo dseditgroup -o create ai-collab
sudo dseditgroup -o edit -a {your-username} -t user ai-collab
sudo dseditgroup -o edit -a ai-agent -t user ai-collab

This group then receives permissions to read and write the folder, so that we both can access it.

# Change group ownership of the shared folder
sudo chgrp -R ai-collab ~/Code

# Give the group Read/Write/Execute(open) access to the shared folder
sudo chmod -R 770 ~/Code

# Give the group permission to 'walk through' your main home folder to reach it 
sudo chmod +a "group:ai-collab allow search" ~

Unlock the ai-agent keychain

Running the ai-agent user with a hidden login will present some issues regarding the Mac OS keychain, so I needed a small workaround as I was logged out from the Claude session all the time.

Login to the ai-agent user and setup a small script:

sudo -u ai-agent -i
nano /Users/ai-agent/run-claude.sh

The script:

#!/bin/bash

# 1. Hardcode the environment variables
export USER=ai-agent
export HOME=/Users/ai-agent
export TMPDIR=/tmp
export PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Users/ai-agent/.local/bin

# 2. Unlock the keychain silently
security unlock-keychain -p "agent-key" login.keychain

# 3. Launch Claude Code and pass any arguments (like 'login' or 'update') to it
exec /Users/ai-agent/.local/bin/claude "$@"

Make the script runnable:

chmod +x /Users/ai-agent/run-claude.sh

Create the aliases

Now, in my normal user, I setup the alias. I'm using Zshrc, so your milage may vary:

# Intercept the claude command to run as the service account
alias claude='sudo -H -u ai-agent env -i TERM=$TERM /Users/ai-agent/run-claude.sh'

alias claude-allow='sudo chmod -R +a "ai-agent allow read,write,execute,delete,add_file,add_subdirectory,file_inherit,directory_inherit" .'

alias claude-revoke='sudo chmod -R -a "ai-agent allow read,write,execute,delete,add_file,add_subdirectory,file_inherit,directory_inherit" .'

This way, we make sure that the claude agent always runs on the restricted account, but still is fully functional including a working keychain.