That sounds interesting. However, I think it’s too difficult a question as in I doubt someone can invent documentation for that.
I was having similar thoughts lately. Voluntarily (as an option, not restricting user freedom) booting into a restricted mode for better security. See also walled garden, firewall whitelisting, application whitelisting, sudo lockdown, superuser mode, protected mode.
We might have this in future.
Progress has been made in that direction.
This is a list of my favorite security enhancement development discussions:
https://forums.whonix.org/tags/security-todo
Help welcome.