Keeping AI agents like ClaudeCode as separate OS user

Why should you keep your AI agent as a separate OS user? For security!