Assuming the agent does not have sudo/doas (because why would it), back up all files to multiple devices / locations, then ensure the files are owned by root and only readable by the agent. Same as how Claude works when one uploads files into a project, they are exposed read-only to Claude's sandbox in a read-only mount.

If the agent needs to modify the files, make the agent clone your read-only mount into a scratch / temporary working directory and then give you a date-version based export for each patch set.

Anything an agent is working with should be a snapshot/clone copy of your files in a disposable container/VM in the event "something goes wrong". Periodically back up its work.