DataOps-platform/docs/superpowers/specs/2026-08-19-enterprise-identity-navigation-move-design.md

Enterprise Identity Navigation Move Design

Status

Approved design option: minimal compatible migration.

Problem

The 企业身份 entry is currently a child of 数据研发, although its page, route, permissions, APIs, and operational responsibility belong to system identity administration. This makes the feature appear to be a data-development tool and separates it from user, audit, and governance administration.

Decision

Move the existing navigation record from 数据研发 to 系统管理 and rename its displayed title to 企业身份与 SSO.

The migration preserves:

• route path /systemManage/enterprise-identity;
• route name systemEnterpriseIdentity;
• component systemManage/enterpriseIdentity;
• permission requirement identity:manage;
• frontend page and backend API behavior;
• existing bookmarks and direct links.

Navigation Order

系统管理 children will be displayed in this order:

1. 用户管理
2. 企业身份与 SSO
3. 设备责任矩阵
4. 审计与运行证据
5. Agent 治理

The existing system-management entries after the insertion will have their sort values shifted to preserve an unambiguous order.

Alternatives Rejected

Duplicate entry in both modules

Rejected because two menu entries would imply two ownership boundaries and make future permission and documentation changes ambiguous.

New URL with an old-path redirect

Rejected because the existing URL already uses the systemManage namespace. Changing it would add migration and redirect complexity without improving the architecture.

Security and Behaviour

• Users without identity:manage will not gain menu visibility or page access.
• No IdP configuration, identity session, audit, or emergency-access behavior changes.
• No API, database migration, OpenAPI, or Docker configuration change is required.
• The current 待企业 IdP UAT status remains unchanged.

Test Plan

1. Add a failing navigation contract proving the entry is absent from 数据研发.
2. Prove the entry is present exactly once under 系统管理 with the preserved path, name, component, icon, and permission.
3. Prove the visible label is 企业身份与 SSO and the system menu order is stable.
4. Run existing enterprise-identity, router, RBAC, and architecture contracts.
5. Build the frontend production bundle.
6. Rebuild only the local UAT frontend and verify the preserved deep link returns successfully.

Rollback

Rollback is a single router-data change: move the same record back under 数据研发 and restore its old title. No persisted data or identity configuration is affected.