Computer-use agents: controlled work with software

What is a computer-use agent?

This kind of agent works with a software environment, observes state and uses tools to complete a multi-step task.

Its ability to act—not simply answer—raises the risk level.

Safe execution boundaries

The execution environment should be separated from unnecessary data and credentials. The agent should see only tools and permissions required for the task.

Allowed actions, scope limits, timeouts, traces and a stop mechanism must be defined before execution.

What is prompt injection? (Read more)

For more on this topic, read Secure identity and access for AI agents in the Liyan knowledge base.

Human approval for consequential actions

Sending, deleting, paying, changing access or publishing should not rely solely on a model decision. An agent can prepare a proposed action while a human approves the final step.

Evaluating computer-use agents

Do not judge only the final outcome. Page path, tools, errors, retries and points where the agent should have stopped matter too.

What is agent observability? (Read more)

Designing an executable task

Split a task into its input, allowed actions, expected outcome and stop conditions. Creating a support ticket from confirmed data is more controllable than handling every message because its scope and end are explicit.

A test environment should use synthetic or minimal data. The agent should not need to see unrelated panels, records or accounts merely to find its way through a task.

Acceptance criteria before production

A good scenario tests more than the happy path: changed pages, incomplete data, errors, slow services and ambiguous requests all matter. A trace should show what the agent saw, decided and why it stopped.

For irreversible actions, propose–summarize–human approve–execute is safer than direct execution. It clarifies accountability and creates a useful decision record.

Scenario: preparing a support request

An agent can open a request form in a test environment, fill required fields from confirmed user text and show a final preview. The send control remains with the person.

If a page changes, a field is missing or input is incomplete, the agent should stop and record why. Unlimited clicking is not a sign of success.

Start with a low-privilege account, test data and a time limit. Expand scope only after reviewing both successful and failed traces.