Firewalling AI Coding Agents Away From Live Trading Code

I run an automated Kalshi prediction market trading system in my Mac lab. I also develop with six Codex accounts, Claude Code, Antigravity, and Cursor, each under a separate macOS user in an ai group. Hard read only firewalls protect my live trading code from those agents. By firewalling, I mean enforcing a boundary around write authority. A prompt can describe the boundary, but an independently enforced control gives it practical force. This article is a reference model for reasoning about and validating that design. Start with the authority of a process under the identity running it. Write an access map before changing permissions. Include the directory around the file, because directory operations can change what a running application sees. Keep tool controls as an additional layer that agrees with the operating system boundary. Test the policy in a disposable fixture under the actual restricted account. Treat read access as a separate decision. Make promotion to the live environment an explicit, reviewable boundary.