I still use separate user accounts for different purposes with heavily restrictive permissions. Good call, that’s an even more effective first line of defense! (I have, however, already implemented it. ;)