If a Mac is to be used by a non-Mac-expert, set up an account for them (in  ► System settings... ► Users & Groups) as the startup login, and do not give this account administrator privileges. Then they will have to give the name and password of an administrator in order to install software or mess up the configuration.

The Guest account that comes with the system lets visitors browse the web, etc., but removes any files they create when they log out.

It is possible to further lock up a Mac, using the "Parental Controls" features of System Preferences. I have never tried this. You can set account attributes to

• Limit an account to use only specified applications.
• Limit an account to use App Store applications by age bracket.
• Limit an account to use only specified desktop widgets.
• Limit an account to use only specified utilties so items can't accidentally be deleted.
• Lock the Dock
• Limit Web access to specific sites.
• Limit Mail and iChat access to specified addresses.
• Limit usage by time of day and hours per day of week.
• Prevent CD and DVD burning.
• Hide "dirty words" in the dictionary.
• Prevent the account from adding or deleting printers.