Computer-use agents look at screenshots and act — clicking, typing, scrolling — through real interfaces. That power inverts your prompt priorities: with a chat model the worst case is a wrong answer; with a GUI agent it's a wrong action — sent, submitted, deleted. Guardrails aren't a nice-to-have section; they're the first thing you write.
Three pillars: hard action boundaries (what it must never click/submit, spelled out concretely — 'never click Send/Submit/Delete/Pay; stop before any irreversible step'), checkpoints (stop and report at named milestones instead of running the whole task blind), and verification over trust ('after each form field, re-read the field from the screen and confirm it matches the source data'). UIs are ambiguous, screenshots go stale mid-action, and popups appear — the prompt must say what to do when the screen doesn't match expectations: stop, don't improvise.
Enter the 14 invoices below into the vendor portal (already logged in, tab open).
HARD RULES:
PROCESS:
DATA: [invoice table]
Collect current pricing for the 6 competitors listed below.
BROWSING RULES:
SHEET RULES:
CHECKPOINT: after the first competitor, stop and show me the row you wrote so I can confirm format before you do the other five.
Claude's computer use works screenshot-by-screenshot: keep instructions in stable UI terms ('the blue Save button in the toolbar') and demand a screenshot-described state check at checkpoints. It respects stop-conditions well when they're explicit and concrete.