# Sanitized screenshot inventory

| File | Evidence |
| --- | --- |
| `01-cli-preflight.png` | Read-only tool, permission, provider, and namespace safety gate. |
| `02-portal-stack-overview.png` | Azure portal subscription Deployment Stacks overview for the isolated lab stack. |
| `03-cli-initial-deploy.png` | Initial subscription-scoped Bicep stack deployment. |
| `04-portal-managed-resources.png` | Portal stack managed-resource inventory. |
| `05-cli-delete-denied.png` | Disposable identity direct deletion denied. |
| `06-portal-deny-assignment.png` | Stack-owned deny-assignment details. |
| `07-cli-write-denied-stack-update.png` | Direct Storage tag update denied; stack-authorized update observed. |
| `08-portal-deny-settings.png` | Final `denyWriteAndDelete` stack settings. |
| `09-cli-detach-and-validation.png` | Detach proof, direct detached-identity update, and stack validation. |
| `10-cli-cleanup-proof.png` | Cleanup and protected-baseline comparison. |

Raw Portal captures belong only in `work/portal-raw/`. Before a capture is copied here, mask tenant and subscription IDs, object IDs, emails, resource IDs, local paths, generated account names, timestamps where needed, and every unrelated resource. The committed CLI screenshots display only sanitized booleans, counts, and generic lab labels.
