Computer-use agents look at screenshots and act — clicking, typing, scrolling — through real interfaces. That power inverts your prompt priorities: with a chat model the worst case is a wrong answer; with a GUI agent it's a wrong action — sent, submitted, deleted. Guardrails aren't a nice-to-have section; they're the first thing you write.
Three pillars: hard action boundaries (what it must never click/submit, spelled out concretely — 'never click Send/Submit/Delete/Pay; stop before any irreversible step'), checkpoints (stop and report at named milestones instead of running the whole task blind), and verification over trust ('after each form field, re-read the field from the screen and confirm it matches the source data'). UIs are ambiguous, screenshots go stale mid-action, and popups appear — the prompt must say what to do when the screen doesn't match expectations: stop, don't improvise.