By admin console, I mean a blank profile with nothing but stock Graphene apps on it. No Gplay store, no F droid, nothing. Its main job is to control esim, profile creation, duress pass, wifi..etc.

Or just a normal daily Main, with secondary profiles OR private spaces?

What i currently have: main profile with main Google (unfortunately), all sensitive in separate profile.

Main profile is my only profile...I used to do the whole main/secondary thing, but it became too annoying having to switch between them all the fucking time.

I use main, that's it. No second profile, no private space.

Nearly all apps installed respect my privacy. Two apps installed that aren't great for privacy. They stay disabled until I need them, then they get disabled again.

Now, if I had a Google, Facebook, etc accounts, those would be in their own profiles.

Yeah I keep Owner as my main daily driver, but it only has FOSS apps. My secondary "slop" profile has anything that is proprietary.

I do exactly the same and the only proprietary app I use on my 2and profile is Waze. Rarely ever use that anyways.

I use Shelter to create a work profile. Not as secure as OS "profile" but significantly more convenient, as I can have both available and receive notifications simultaneously, while still maintaining some level of sandboxing.

So funny, I was just searching for these functions yesterday. (As is which os has it).

My ideal would be:
One sandbox instance with reading apps - that unlocks with fingerprint.
And a second for everything else.

Motorola can't come fast enough. I'm even tempted to get one without external sd card.

Same

My threat model didn't need the hassle of swapping profiles and such. Main profile and reap the other benefits of Graphene. All good.

If it requires Google play or isn't used often it goes into my work profile which I disable when I'm not using it. That means it's pretty much Google Maps, and that's pretty much it.

I'll be honest: I am too lazy to switch profiles. I've done the best I can (for now) to eliminate propriety apps. I only have 12/100, and that's including Google Play Services, Play Store, and Android Auto as 3 of them. 2 of the rest do not have network permissions.

All my privacy-friendly stuff on main, and privacy invasive on a Shelter work profile. One journalism account on instagram in a separate user.

I use a secondary profile as my main, don't really ever use the owner profile unless I want to activate the wifi access point.

Also I don't have google anything installed, I use open source apps exclusively.

I run three profiles: main profile is where all my FOSS stuff is, every day things, no tracking stuff allowed. And of it does, I just revoke network permissions. No Google play services or play store installed on this profile at all

Secondary profile has banking apps, basically anything at all to do with money or requires Google play services to work. I even disable network access for most of the apps on my secondary profile until I need to use them. Google play services and play store are installed on this profile.

Third profile is dedicated navigation user that just has Google maps and other amenities like music for listening while driving. I have this one separated because I allow my secondary profile to run in the background and I don't want Google maps running in the background so I created a third user. The third profile doesn't run in the background. It's pretty easy, I just switch to it when I need solid navigation. This of course also has play services installed. I know this is overkill. It's just for myself because location tracking is a particular peeve of mine

All my profiles have Molly installed and connected up so I never miss a text or call between profiles

This is native now in Graphene. No need for Shelter anymore:
https://discuss.grapheneos.org/d/16670-private-space-on-android-15-grapheneos

x3

I tend to use my main profile as my main one and set up secondary profiles for whatever I might need them for. I tried a private space but really wished it shared the VPN with my main profile so I didn't like it much.

No profile, no Google.

I have google and all proprietary apps in private profile, which stays closed unless I need to open one. On main I have open source apps, apart one or two

Hmmm. I like that admin + console idea. Might try that when I'm ready for a clean install. Otherwisey current set up is Owner with everything de-googled, and a work profile with a few apps needed there.