This is the kind of thing where everything will be fine until it rm -rf:s everything you care about, and then you will be shocked that it never did that before. This has already happened publicly to hundreds of people, in private probably thousands. Be better than them and learn from the mistakes of others.

The actually sane default is to treat it like a junior trainee you would never trust with rights to anything critical. Use existing operating system facilities, namely user accounts and file permissions, to make everything it doesn't need protected from writes, and everything it shouldn't blithely broadcast to the world like private data and keys, also protected against reads.