[Luke Shiels (skve)]

The docs mixed product tasks with SDK setup, overused sidebar icons, and left security controls buried in a short overview. The navigation now uses icons only for product destinations, keeps release and identity setup under SDK configuration, and places the API item under Developer tools with the label “API”.

Surfaces has a product-focused Releases guide. Security now has dedicated identity-provider, SSO, SCIM directory-sync, verified-domain, network-access, and published-IP-range pages. Verified domains live under Security and explain verification and enrollment. Correct the previous claim that activating SSO disables email codes and passkeys; the current settings flow retains them.

Add seven Mermaid diagrams for product evidence, releases, authentication, provisioning, domain verification, and network decisions. Add availability and warning callouts plus a focused surface Events screenshot. Diagram controls sit above the graphic so they do not cover labels and remain usable on mobile. This follows Cloudflare's visual guidance.

Network allowlisting is already Enterprise-only in the product: Stripe grants network-access only to Enterprise, the API rejects nonempty rule writes without a current entitlement, and the UI hides editors. No application behavior change is needed. The docs now make the restriction explicit and describe downgrade recovery without confusing workspace allowlisting with the public IP address feed.

Validation:

• Docs format, lint, typecheck, Mintlify validation, link/anchor checks, and git diff checks pass.
• Browser review covered the sidebar, Events screenshot, diagrams, callouts, light/dark themes, and mobile zoom.
• Existing API network-plan and downgrade tests: 3 passed.
• Existing browser test for the Enterprise notice and hidden editors: passed.
• The separate browser downgrade-recovery test timed out waiting for Remove restrictions after the local sync fixture returned HTTP 401. API downgrade recovery passed; browser recovery remains unverified.

Product tests ran in the dependency-equipped application checkout after confirming the network gating and browser test files match the working checkout. Authoring instructions record the product/SDK boundary, icon rules, and visual conventions.