I've got two young sons who are allowed on the computer only for homework purposes during the school week, using a separate account with pretty strict parental controls on it. They're allowed to launch AppleWorks and a few other apps that help them through their homework, but cannot launch Safari or any other web browser.
That worked well (or so I thought) until I stepped into the family room the other night & caught the eldest hammering away at a Flash game inside of Safari (his biggest weakness, and his biggest time waster), while still in the restricted account! He fessed up that he had discovered (some time ago in fact) that you can launch Safari (or whatever the default web browser is) from inside Dashboard; click on the X in the lower-left corner, click on Manage Widgets, then on the More Widgets button, and bingo! you're in.
Turns out that restricting an app within the Parental Controls prefs panel only keeps that user from launching the specified app from within the Finder; if another app calls on the web browser, it'll launch, no questions asked. Dashboard was easy enough to defeat; just use terminal to disable Dashboard and that's it. But if an app uses web-based help resources and the help menu refers the user to the web, that's a hole. And to top it off, in AppleWorks there's no way to stop a user from launching a web browser; all you need to do is go to the Starting Points, click on the Web tab, and open one of the docs there, any of which contain numerous hyperlinks. Even without the Starting Points trick you can create a hyperlink inside any AppleWorks document (or Word doc, or...)
So, if I want to keep my kid's nose to the grindstone and keep him from getting sidetracked on the stoopid games, what is the best method to lock him out of web content?