Encrypt the startup disk with FileVault

Turn it on in System Settings → Privacy & Security → FileVault. You need to be an administrator to do it.

What changes is who can open the disk. A Mac with Apple silicon or an Apple T2 Security Chip already encrypts its data automatically, but FileVault adds a layer on top: your login password is required to decrypt the disk, and nothing gets read without it.

While you turn it on, macOS asks how you want to get back in if you forget that password: by letting your iCloud account unlock the disk, or with a recovery key, a string of letters and numbers created for you. If you take the key, write it down and keep it somewhere that is not the Mac. Forget both the password and the key, and the files are gone for good — which is precisely the guarantee you are buying.