# Nexus Policy Engine v1 — Screenshot Notes

Capture these after logging in with role **User** (default POC profile). Restart shell if policies were seeded on first run.

## policy-model.png

**What:** File explorer or editor showing policy JSON structure.

**Steps:**
1. Open `%LocalAppData%\NinjaNexus\policies\default-user.json`
2. Highlight `role`, `allowApps`, `denyApps`, `denySettingsSections`
3. Optional: side-by-side with `Assets/Policies/default-developer.json` for contrast

## policy-launcher.png

**What:** Launcher with denied apps hidden (User role).

**Expected (User):**
- Visible: Files, Browser, Photos, Media, Calculator, Settings, RenNinja OS
- Hidden: Ninja Store, Enheder, Terminal, HUB, external Notepad

**Steps:**
1. Open launcher (dock Apps or shortcut)
2. Screenshot pinned/all-apps grid — store and device-manager absent

## policy-store.png

**What:** Store access blocked or empty catalog for User.

**Steps:**
1. As User, try opening Ninja Store from launcher (should be hidden)
2. If opened via deep link, expect policy message: "Ninja Store er ikke tilgængelig for din rolle"
3. Switch profile role to `PowerUser` in `profile.json`, restart — store catalog should populate

## policy-console.png

**What:** Console access denied for User; limited commands for Developer.

**User:**
1. Settings → Nexus Console button should be hidden/disabled
2. Direct open attempt shows "Adgang nægtet"

**Developer** (set `role` to `Developer` in profile):
1. Open Nexus Console
2. Run `windows-lock` → expect "Blocked by policy" (if not Administrator+)
3. Run `help` → succeeds

## Agent policies (bonus)

```powershell
Invoke-RestMethod http://127.0.0.1:17890/agent/policies
```

Adjust port from agent status. Screenshot JSON response with `evaluationMode: read-only`.
