Here are a couple of (open-source Apache license) projects I wrote to sandbox on Mac, which I use to run my agents, while still being able to build/run macOS apps:

Limited user account: https://github.com/webcoyote/sandvault

Virtual machine: https://github.com/webcoyote/clodpod