Organization Architecture
golemsec is modeled as GolemSec Ltd., an Israeli financial-services firm operating two lines of business:
- Insurance — selling and servicing policies (life, health, auto, property), handling claims.
- Stock brokerage — managing client brokerage accounts, holdings, trades, and cash transactions.
Departments
The company is organized into 10 departments, each an Organizational Unit under OU=golemsec in Active Directory, with a matching security group.
| Department (OU) | Function |
|---|---|
| Executive | Leadership (CEO, CISO, CFO) |
| Finance | Accounting, payroll, treasury |
| HR | People operations, onboarding |
| Sales | Insurance & brokerage sales |
| Marketing | Campaigns, brand |
| IT | Systems administration, identity, infrastructure |
| Operations | Policy/claims processing, back office |
| Support | Client service / helpdesk |
| Legal | Compliance, contracts |
| RnD | Development department (the dev tooling) |
People
- 200 employee user objects live under
OU=<dept>,OU=golemsec,DC=corp,DC=golemsec,DC=io. - Each has
sAMAccountName=firstname.lastname, a display name, department membership, and an Exchange mailboxfirstname.lastname@golemsec.io. - All 200 share a default password for the lab (see Credentials & Break-Glass).
- Identity is real: employees authenticate to apps with their AD account through SSO (see Identity & SSO).
The business data domain
A single source of business truth — the golemsec_corp PostgreSQL database — models the company end-to-end:
Full table sizes and sensitive columns are documented in Data Model.
How a business day flows
- Sales close insurance policies and open brokerage accounts → recorded against clients in the business DB; CRM (SuiteCRM) tracks the relationship.
- Operations / Support process claims and service requests → helpdesk (GLPI) and the claims table.
- Finance runs accounting in Akaunting / ERPNext; payroll references employee salary data.
- HR manages people in OrangeHRM, mirrored by AD accounts.
- IT runs identity (AD + Keycloak), monitoring (Zabbix/Grafana), patch (WSUS), and backup (Veeam).
- RnD ships code via GitLab + Jenkins on the dev server.
The recurring real-world constraint that drives the build: employees must be able to authenticate to these tools with their own company identity — which is what the identity fabric solves.