I give my agents a dedicated system user with their own home. It's not sandboxing - they can still read many of my files (which is actually convenient) and they could exploit local vulnerabilities to get root, of course. But I find it to be a good compromise. I'm not as concerned about the agent turning evil than I am about it doing harm on good will.

They have their own clone of the repo they're working on. And when they're done, I pull their commits from my own git working copy, with my system user, and then push it to my bare repos, which acts both as an easily backupable source and as my CI, with their post-update hooks. The whole "pull from codex, then push to bare repo" is so common that I made for myself a `meat_proxy` command that automates it. I'm some lazy meat.