Set up a mac with an Admin and non-Admin account

I set up my mac such that my main account is not an admin, and I have a separate admin account. This was motivated by the idea that I might unwittingly pick up a virus. If this is in a non-admin account, it is much less likely to get access to system files. It also makes it easier to completely delete and rebuild my personal account if need be, without having to rebuild the whole operating system (which one might have to do if a virus gets into the System files). Note: these are my thoughts on the matter, and not those obtained through thorough discussions with security experts. This is just meant to explain why I set up my mac this way. I also note, I am aware of other users who have similar needs with similar or different motivations.

One issue that occurs with such a setup is that many software applications, such as Homebrew, at least previously, assumed you are a privelagaged user. Some Homebrew formula at least still assume this, for example, assuming you can copy an application to the /Applications folder. You may also desire to have a single brew environment or Anaconda - Python environment, shared by your main account as well as your admin account, such that the non-admin user is able to brew install <package> and pip install <package>. This is not possible out of the box, but it is very straightforward enable.

Create a shared group and directory

These instructions use commands in a terminal, often called command line (CL) or command line interface (CLI).

Step 1: create a new group and add users

With your <admin> user account (where <admin> is a place holder for your actual short user name), create a new group (sudo means do as a super-user, and the first time used, will prompt for your <admin> password - the password prompt will be valid for some relatively short time such that future sudo calls will not ask for a password. This times out after a minute or so)

sudo dseditgroup -o create -r "group for brewing together" brew
sudo dseditgroup -o edit -a <admin> -t user brew
sudo dseditgroup -o edit -a <non-admin> -t user brew

Similarly, add any other user to this brew group who you would like to be able to not only read, but also write files, enabling brew install <package> and similar features.

Step 2: enable a directory to have group read/write access with new files/directories inherriting the permissions

Now that we have a new group, we need to enable a folder to inherrit the desired permissions.