Administration IA phase 1: re-shelve the SaaS side into get-started / concepts / guides / reference

content/docs/administration/_index.md

@@ -20,33 +20,33 @@ aliases:
 link_buttons:
   primary:
     label: Get Started
-    link: /docs/administration/organizations-teams/
+    link: /docs/administration/get-started/
 
 sections:
 - type: button-cards
   heading: Getting started
   cards:
   - icon: rocket-launch
-    heading: Onboarding Guide
-    link: /docs/administration/onboarding-guide/
-    description: Set up Pulumi for your organization with guidance on subscriptions, security, team structure, and migration.
+    heading: Get Started
+    link: /docs/administration/get-started/
+    description: Set up Pulumi for your organization with guidance on editions, security, team structure, and migration.
 
   - icon: buildings
-    heading: Organizations & Teams
-    link: /docs/administration/organizations-teams/
-    description: Create organizations, manage teams, configure user accounts, and assign billing managers.
+    heading: Concepts
+    link: /docs/administration/concepts/
+    description: Organizations, accounts, billing managers, access tokens, role-based access control, audit logs, and customer managed keys.
 
-  - icon: lock-key
-    heading: Access & Identity
-    link: /docs/administration/access-identity/
-    description: Configure access tokens, RBAC, SAML SSO, SCIM, and OIDC for authentication.
+  - icon: gear
+    heading: Guides
+    link: /docs/administration/guides/
+    description: Configure SAML SSO, SCIM provisioning, OIDC issuers, audit log export, customer managed keys, and least privilege.
 
-  - icon: shield-check
-    heading: Security & Compliance
-    link: /docs/administration/security-compliance/
-    description: Set up audit logs and customer managed encryption keys.
+  - icon: books
+    heading: Reference
+    link: /docs/administration/reference/
+    description: Lookup tables, including the complete catalog of RBAC scopes.
 
-  - icon: buildings
+  - icon: cloud
     heading: Self-Hosting
     link: /docs/administration/self-hosting/
     description: Deploy Pulumi Cloud in your own infrastructure with the Business Critical edition.

content/docs/administration/concepts/_index.md

@@ -0,0 +1,33 @@
+---
+title: Concepts
+title_tag: Pulumi Cloud Administration Concepts
+h1: Concepts
+meta_desc: The Pulumi Cloud organization and access model — organizations, accounts, billing managers, access tokens, RBAC, audit logs, and customer-managed keys.
+menu:
+  administration:
+    name: Concepts
+    parent: administration-home
+    identifier: administration-concepts
+    weight: 20
+aliases:
+  - /docs/administration/organizations-teams/
+---
+
+How Pulumi Cloud models your organization and who can do what inside it. Read these to understand the system; see [Guides](/docs/administration/guides/) for the procedures that configure it.
+
+## Organization and identity
+
+- [Organizations](/docs/administration/concepts/organizations/) — the top-level container that owns your stacks, environments, and settings.
+- [Accounts](/docs/administration/concepts/accounts/) — individual user accounts, profiles, and identity providers.
+- [Agent accounts](/docs/administration/concepts/agent-accounts/) — accounts for AI agents and automation acting on your organization's behalf.
+- [Billing managers](/docs/administration/concepts/billing-managers/) — the role that delegates billing access without granting admin rights.
+- [Access tokens](/docs/administration/concepts/access-tokens/) — personal, team, and organization tokens for authenticating the CLI, CI/CD, and the REST API.
+
+## Access control
+
+- [Role-based access control (RBAC)](/docs/administration/concepts/rbac/) — entities, scopes, permission sets, roles, and teams, and how permissions accumulate across them.
+
+## Security and compliance
+
+- [Audit logs](/docs/administration/concepts/audit-logs/) — the record of user and system activity in your organization.
+- [Customer managed keys](/docs/administration/concepts/customer-managed-keys/) — using your own encryption keys to protect data at rest.