diff --git a/backend/internal/deployment/service_management_test.go b/backend/internal/deployment/service_management_test.go
new file mode 100644
index 0000000..1fd5e94
--- /dev/null
+++ b/backend/internal/deployment/service_management_test.go
@@ -0,0 +1,74 @@
+package deployment
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+func TestDeployRejectsManagementDomainFromNginxConfigWhenPolicyFileIsMissing(t *testing.T) {
+	client := newMemoryClient()
+	server := testServer("nginx-management-server")
+	client.runResults = []CommandResult{
+		{ExitCode: 1},
+		{ExitCode: 0, Output: []byte(`
+http {
+	server {
+		listen 443 ssl;
+		server_name odacm.cn;
+		location / {
+			proxy_pass https://127.0.0.1:8443;
+			proxy_ssl_name odacm.cn;
+			proxy_ssl_verify on;
+		}
+	}
+}
+`)},
+	}
+	service := NewService(memoryFactory{clients: map[string]*memoryClient{server.ID: client}})
+
+	report := service.Deploy(context.Background(), []Target{{Server: server, DomainName: "odacm.cn"}}, testArtifact(t))
+	if report.Status != "failed" || report.Failed != 1 {
+		t.Fatalf("missing policy must reject management domain deployment: %+v", report)
+	}
+	if report.Results[0].FailureCode != FailureManagementConflict {
+		t.Fatalf("unexpected failure code for missing policy: %+v", report.Results[0])
+	}
+	if len(client.commands) != 2 || client.commands[0][0] != "test" || client.commands[1][0] != "nginx" {
+		t.Fatalf("unexpected missing-policy probe commands: %v", client.commands)
+	}
+}
+
+func TestNginxServerBlockIsManagedRequiresAllProtectionDirectives(t *testing.T) {
+	base := `server {
+	server_name odacm.cn;
+	proxy_pass https://127.0.0.1:8443;
+	proxy_ssl_name odacm.cn;
+	proxy_ssl_verify on;
+}`
+	cases := map[string]struct {
+		config string
+		want   bool
+	}{
+		"complete": {config: base, want: true},
+		"missing_verify": {
+			config: strings.Replace(base, "proxy_ssl_verify on;", "", 1),
+		},
+		"wrong_upstream": {
+			config: strings.Replace(base, "https://127.0.0.1:8443", "https://127.0.0.1:9443", 1),
+		},
+		"wrong_sni": {
+			config: strings.Replace(base, "proxy_ssl_name odacm.cn", "proxy_ssl_name other.example", 1),
+		},
+		"wrong_server_name": {
+			config: strings.Replace(base, "server_name odacm.cn", "server_name other.example", 1),
+		},
+	}
+	for name, testCase := range cases {
+		t.Run(name, func(t *testing.T) {
+			if got := nginxContainsManagedServer(testCase.config, "odacm.cn"); got != testCase.want {
+				t.Fatalf("managed server detection mismatch: got=%t want=%t", got, testCase.want)
+			}
+		})
+	}
+}