why can't you just create another user account and make sure auto login is off?
or are you worried he's snoopy and technical enough to hack into your other user account? If that's the case, the "physical access" rule applies, and you either need to not allow use of the computer, or filevault your account. (maybe scrounge up a cheap computer for guests to use, that's what I did here, the guest room has its own older imac)
