As a separate locked-down user would probably also work.