diff --git a/test/case/system/nacm-basic/test.adoc b/test/case/system/nacm-basic/test.adoc
index 62626851..d18b8d16 100644
--- a/test/case/system/nacm-basic/test.adoc
+++ b/test/case/system/nacm-basic/test.adoc
@@ -5,21 +5,20 @@ ifdef::topdoc[:imagesdir: {topdoc}../../test/case/system/nacm-basic]
 ==== Description
 
 Test that NACM groups (admin, operator, guest) correctly enforce
-access control with path-based rules and default policies.
+access control with permissive defaults and targeted denials.
 
-Creates three user privilege levels from scratch:
+The NACM design is "permit by default, deny sensitive items":
 
-- admin: Full access (permit-all rule)
-- operator: Can manage interfaces/routing, cannot modify system config
-- guest: Read-only access (write-default: deny, exec deny rule)
+- admin: Full unrestricted access (permit-all rule)
+- operator: Can configure everything EXCEPT passwords, keystore, truststore
+- guest: Read-only access (explicit deny of create/update/delete/exec)
 
 Verifies that:
 
-- All users can read configuration (read-default: permit)
-- Operators can modify interfaces (path-specific permit rule)
-- Operators cannot modify system configuration (write-default: deny)
-- Guests cannot modify any configuration (write-default: deny)
-- Admin can modify all configuration (permit-all rule bypasses defaults)
+- Operators can read and modify most configuration (hostname, interfaces)
+- Operators CANNOT read or write password hashes (protected path)
+- Guests can read but cannot modify any configuration
+- Admin can access everything including passwords
 
 ==== Topology
 
@@ -31,9 +30,11 @@ image::topology.svg[Basic NACM permissions topology, align=center, scaledwidth=7
 . Configure NACM groups, rules, and test users
 . Verify operator can read configuration
 . Verify operator can modify interface configuration
-. Verify operator cannot modify system configuration
+. Verify operator can modify hostname
+. Verify operator cannot read password hashes
+. Verify operator cannot write password hashes
 . Verify guest can read configuration
 . Verify guest cannot modify configuration
-. Verify admin can modify configuration
+. Verify admin can access passwords