I think that explanation of default qubes would help here. It’s not in the docs yet, but might help the new users to understand the implied set of trust levels:
I was looking for explanation, why exactly you need all those many qubes in the beginning and what you expect to do with them. For example:
Sys-net contains drivers for your WiFi card and connects to the network, so it’s untrusted by default (don’t run Firefox there!). Sys-firewall protects you from DMA attacks (if I’m not mistaken) and allows to use the “Firewall rules” in the Settings of other qubes. Sys-whonix provides Tor connection to anon-whonix (in which you should run Tor browser). All…