# Enterprise Identity Navigation Move Design

## Status

Approved design option: minimal compatible migration.

## Problem

The `企业身份` entry is currently a child of `数据研发`, although its page, route, permissions, APIs, and operational responsibility belong to system identity administration. This makes the feature appear to be a data-development tool and separates it from user, audit, and governance administration.

## Decision

Move the existing navigation record from `数据研发` to `系统管理` and rename its displayed title to `企业身份与 SSO`.

The migration preserves:

- route path `/systemManage/enterprise-identity`;
- route name `systemEnterpriseIdentity`;
- component `systemManage/enterpriseIdentity`;
- permission requirement `identity:manage`;
- frontend page and backend API behavior;
- existing bookmarks and direct links.

## Navigation Order

`系统管理` children will be displayed in this order:

1. `用户管理`
2. `企业身份与 SSO`
3. `设备责任矩阵`
4. `审计与运行证据`
5. `Agent 治理`

The existing system-management entries after the insertion will have their sort values shifted to preserve an unambiguous order.

## Alternatives Rejected

### Duplicate entry in both modules

Rejected because two menu entries would imply two ownership boundaries and make future permission and documentation changes ambiguous.

### New URL with an old-path redirect

Rejected because the existing URL already uses the `systemManage` namespace. Changing it would add migration and redirect complexity without improving the architecture.

## Security and Behaviour

- Users without `identity:manage` will not gain menu visibility or page access.
- No IdP configuration, identity session, audit, or emergency-access behavior changes.
- No API, database migration, OpenAPI, or Docker configuration change is required.
- The current `待企业 IdP UAT` status remains unchanged.

## Test Plan

1. Add a failing navigation contract proving the entry is absent from `数据研发`.
2. Prove the entry is present exactly once under `系统管理` with the preserved path, name, component, icon, and permission.
3. Prove the visible label is `企业身份与 SSO` and the system menu order is stable.
4. Run existing enterprise-identity, router, RBAC, and architecture contracts.
5. Build the frontend production bundle.
6. Rebuild only the local UAT frontend and verify the preserved deep link returns successfully.

## Rollback

Rollback is a single router-data change: move the same record back under `数据研发` and restore its old title. No persisted data or identity configuration is affected.