How to run a Hosted macOS agent task *without* root permissions?

[AArnott]

I need to run tests on macOS that must not run with root permissions. But Hosted macOS agents run with super user permissions by default. How can I opt a task (or the whole job) out of super user permissions?

Justification:
macOS-12 generally requires binaries to be signed and have entitlements properly set. But for super user accounts, this requirement is dropped. As part of my tests, I want to validate that my program will actually work on a mac for the ordinary user. I can't do that when the tests pass even though they should be failing.

[mikhailkoliada]

@AArnott Hello, a task itself does not limit your permissions as far as I am aware. You have to run rootless agent in first place and register it in github/azure devops

[AArnott]

Thanks. I'm a fan of the Hosted agents providing root access. But the inability to get out of that root access for a particular task is a bummer. Setting up an on-prem agent just for this purpose seems like an enormous hassle compared to what I would expect.

Is there no linux/macOS command that can escape the elevation that my task script can execute? Or is there a user account I can su user to in order to run a command under some non-elevated user account? For example if these agent images were created with a 'guest' account or something, I could su guest and run a command under that account.