Administration IA phase 1: Re-shelve the SaaS side into get-started / concepts / guides / reference

[jkodroff]

Phase 1 of the Administration IA restructure. Create the four standard shelves and move the SaaS-side pages onto them.

Pure git mv + alias. No prose edits. The four concept/procedure hybrids (organizations.md, audit-logs/_index.md, customer-managed-keys/_index.md, rbac/teams.md) move unsplit and land in concepts/; Phase 3 splits them.

All paths relative to content/docs/administration/.

get-started/ — from onboarding-guide/

The onboarding guide already is a get-started path: a linear "do this first" sequence, which is what get-started means in every other section.

Current	Proposed
onboarding-guide/_index.md	get-started/_index.md
onboarding-guide/choose-edition.md	get-started/choose-edition.md
onboarding-guide/setting-up-for-success.md	get-started/setting-up-for-success.md
onboarding-guide/ways-of-working.md	get-started/ways-of-working.md
onboarding-guide/migrating-to-pulumi.md	get-started/migrating-to-pulumi.md

Its page title ("Setting Up Pulumi for Your Organization") and menu label ("Onboarding Guide") already disagree — settle on one during the rename.

concepts/ — the org and access model

Current	Proposed
organizations-teams/organizations.md	concepts/organizations.md
organizations-teams/accounts.md	concepts/accounts.md
organizations-teams/agent-accounts.md	concepts/agent-accounts.md
access-identity/access-tokens.md	concepts/access-tokens.md
security-compliance/audit-logs/_index.md	concepts/audit-logs.md
security-compliance/customer-managed-keys/_index.md	concepts/customer-managed-keys.md
access-identity/rbac/_index.md	concepts/rbac/_index.md
access-identity/rbac/entities.md	concepts/rbac/entities.md
access-identity/rbac/scopes.md	concepts/rbac/scopes.md
access-identity/rbac/permission-sets.md	concepts/rbac/permission-sets.md
access-identity/rbac/roles.md	concepts/rbac/roles.md
access-identity/rbac/teams.md	concepts/rbac/teams.md

guides/ — provider-specific and task-specific procedures

Current	Proposed
access-identity/saml/ (10 files: _index, sso, saml-admin, okta, entra, gsuite, jumpcloud, onelogin, auth0, troubleshooting)	guides/saml/ — same 10
access-identity/scim/ (5 files: _index, okta, entra, onelogin, troubleshooting)	guides/scim/ — same 5
access-identity/oidc-issuers/ (5 files: _index, github, gitlab, kubernetes-eks, kubernetes-gke)	guides/oidc-issuers/ — same 5
security-compliance/audit-logs/aws-s3.md	guides/export-audit-logs/aws-s3.md
security-compliance/audit-logs/azure-sentinel.md	guides/export-audit-logs/azure-sentinel.md
security-compliance/customer-managed-keys/aws-kms.md	guides/customer-managed-keys/aws-kms.md
security-compliance/least-privilege/_index.md	guides/least-privilege.md
organizations-teams/billing-managers.md	guides/billing-managers.md

least-privilege/ is a directory containing only _index.md — flatten it to a single file.

Both new guides/ subdirectories (export-audit-logs/, customer-managed-keys/) need an _index.md. A minimal one is fine here; Phase 3 writes the real landing pages.

reference/ — lookup tables, not reading material

Current	Proposed
access-identity/rbac/scopes/stacks.md	reference/rbac-scopes/stacks.md
access-identity/rbac/scopes/environments.md	reference/rbac-scopes/environments.md
access-identity/rbac/scopes/insights-accounts.md	reference/rbac-scopes/insights-accounts.md
access-identity/rbac/scopes/org-settings.md	reference/rbac-scopes/org-settings.md

concepts/rbac/scopes.md (what a scope is) stays with the model and links out to these tables.

Retired containers

These three landing pages have live URLs. Alias them rather than deleting them.

Retired	Alias target
organizations-teams/_index.md	/docs/administration/concepts/
access-identity/_index.md	/docs/administration/concepts/rbac/
security-compliance/_index.md	/docs/administration/concepts/audit-logs/

Redirect stubs to retarget

Stub	Current redirect_to	Should be
organizations-teams/teams.md	/docs/pulumi-cloud/access-management/rbac/teams (legacy path, itself only reachable via alias)	/docs/administration/concepts/rbac/teams/
access-identity/stack-permissions.md	/docs/administration/access-identity/rbac/permission-sets#stack-permission-sets	/docs/administration/concepts/rbac/permission-sets#stack-permission-sets

Acceptance

• 46 files moved with /move-doc (handles git mv, alias injection, menu frontmatter, internal link updates)
• Every pre-existing alias on every moved page is preserved on top of the new one
• Three retired container landing pages aliased, not deleted
• Two redirect stubs retargeted at canonical paths
• data/docs_menu_sections.yml untouched (the administration top-level menu is unchanged); menu weights reordered within the section so the sidebar reads get-started → concepts → guides → reference → self-hosting
• make lint passes
• Alias verification pass clean
• Zero prose changes in the diff

Part of the Administration IA epic. Proposal with full rationale: https://claude.ai/code/artifact/3dfed61d-a02c-4feb-9f9d-c77d7b33accb