Modular window canvas with grouped operations hub access, privacy-safe layout proposals, and fail-closed visibility gating.
Only entitled modules are shown. Search never reveals blocked modules.