The ONLY access that will be allowed is for Email and an online messenger service, such as ICQ or MSN Messenger.
use iptables (linux)
You can specify which hosts (presumably the mail servers and login.oscar.aol.com) to allow and deny all other traffic.
allow outgoing tcp traffic on ports 25, 143, 110, 5190, 80--you can even log all traffic if you want and email it to his PO automatically.
DROP everything else.
don't give him root access. he doesn't need it to run it well. the PO should set the password.
disable single user mode; disable booting from anything else other than the hard disk; password protect the bios
do a minimum installation; set all scripts/binaries to root read/execute only (something like chmod root * -R; chgrp root * -R); except pine (for email), write/talk (for instant messaging), lynx (for browsing the web). X windows or not X windows...that is the question.
disable all unnecessary services.
disable him access to /bin/chmod to prevent him from executing other files such as cracks exploiting security vulnerabilities leading to escalation of local priviledges.
also disable /bin/mount to prevent him from using a cdrom or floppy drive (check /etc/fstab to make sure it's not there).
should take you a few hours to set up and test.
if I had that setup on my computer, I wouldn't be able to break it (unless I threw it off a bridge). to prevent him from opening his laptop and trying to reset the bios, have your PO paste a seal (the ones which are impossible to get off without tearing them) over the screws and sign it.
if you want, I can help you set it up over IM over a weekend.
If you can set up a laptop like this and ask your PO to get his computer expert friends in law enforcement to try to break it, he might agree to it.