How can I ensure that bitcoind does not use unspent outputs for a given address? With RPC calls to bitcoind, from separate (python) scripts, I'm:


calling getnewaddress to set up a new key pair for a 'special' address, assigned to a distinct account (let's call this 'specialAccount')
building raw transactions (outside bitcoind) that spend outputs to this special address and then calling bitcoind to sign send


In addition to the above, it is possible that bitcoind is also called directly, to make payments, or whatever.

How can I be absolutely sure that bitcoind does not consume outputs to my special address outside of signing outputs to this address in signrawtransaction? 

We can assume that there are no calls that explicitly spend from 'specialAccount', but the problem is that, as I understand it, it is possible for bitcoind to borrow arbitrary unspent outputs for the purpose of paying transaction fees. (See this issue, for example, and also this one.)

Is there any way for me to lock the special address, and prevent this being used to pay transaction fees for other accounts, or to otherwise be able to use bitcoind to sign raw transactions that use outputs to this address without making the public key for the address more generally available within bitcoind?
You can use lockunspent to lock (in-memory only) unspent inputs created by transactions whose at least one output was pointing to your "special address".