I recommend you actually have a reference install on a working AGX, and then clone this. The clone (if you look at the raw image, not the sparse image) can be loopback mounted, examined, edited, or updated with something like rsync (or the reverse…used for rsync update of another image). Before cloning you can make customizations, update packages, so on.
The primary issue would be that accounts are also cloned, and so you’d only want to add an account which every person is going to use, or else remove other accounts prior to the clone (or you could clone with those accounts, load it onto another AGX, and then remove the accounts from the second AGX, and clone the edited second AGX). Keep in mind that the reason NVIDIA no longer ships units with a default admin login and password is due to California law against doing so.
A typical clone would be something like this: sudo ./flash.sh -r -k APP -G my_backup.img jetson-xavier mmcblk0p1
The above would produce raw file “my_backup.img.raw” (the size of the entire rootfs), plus sparse file “my_backup.img” (a sparse file). Sparse files cannot be loopback mounted or edited, but are faster to flash. A raw file can be used to create a sparse file using a NULL filler and “bootloader/mksparse”. Either raw or sparse works for flash if the file name is renamed to “bootloader/system.img” and you then use the “-r” option to “reuse” the existing system.img.