There may already be a JBS issue to update the documentation to specify the code source of a module installed in an image "jrt:/<module>".

It may be useful to add an example as a comment in $JAVA_HOME/conf/security/java.policy to make it easy to reference since the deprivileged modules are now moved to the private default.policy.