Ask HN: How to truly sandbox AI tools on a Mac?

Beyond the given macOS protections (say iCloud/Photos, Full Disk Access, etc.), what’s the best way to hard-sandbox AI tools to prevent unauthorized/unintended file or network access?

I am looking for ways to secure this proactively without depending upon the LLL/tool provider's promise or declared guidelines/ethics, but other than buying a second dedicated computer.