Design Corporate Intranet - System Design | WinJob

Problem Statement: Corporate Intranet as Employee Hub

A corporate intranet is the authenticated home for employees: curated news, policy libraries, org directory, and team sites behind the corporate firewall. Interviews probe whether you treat it as a multi-tenant portal where every artifact carries company_id, visibility scopes, and immutable document versions—not a public CMS with login bolted on. Microsoft SharePoint, Google Sites, and Workday-style hubs all converge on the same tension: employees need Google-fast search while security mandates zero cross-department leaks.

The dominant failure modes are search ACL drift after LDAP group changes, watermark latency on PDF downloads, and announcement fanout storms during all-hands. Your design should separate the authoritative metadata plane (Postgres or Spanner) from blob storage (S3-compatible) and search derivatives (OpenSearch) fed by an outbox. Reads are 8:1 versus writes; peak happens at 9am local time per region.

Engineering notes (problem-statement-corporate-intranet-as-employee-hub)

Propagate company_id from JWT; reject mismatched path params.
Commit document version before search indexer or watermark queue.
Run deny-leak canaries after every bulk ACL or HRIS group sync.
Degrade announcement personalization before search snippets.
Log every download with user_id, version_id, watermark_status.

javaOne Dark Pro

1 public final class IntranetGuard1 {
2   public boolean canAccess(String companyId, String libraryId, Set<String> adGroups, String requiredRole) {
3     if (companyId == null || libraryId == null || adGroups == null) return false;
4     return adGroups.contains(requiredRole) || adGroups.contains("intranet-admin");
5   }
6 }

pythonOne Dark Pro

1 def principal_bitmap_version(company_id: str, document_id: str, grants: list[str]) -> str:
2     import hashlib
3     payload = f"{company_id}:{document_id}:" + "|".join(sorted(grants))
4     return hashlib.sha256(payload.encode()).hexdigest()[:16]

typescriptOne Dark Pro

1 export interface DocumentVersionRow {
2   companyId: string;
3   libraryId: string;
4   documentId: string;
5   versionId: string;
6   blobKey: string;
7   aclBitmapVersion: string;
8   focus: "problem-statement-corporate-intranet-as-employee-hub";
9 }

Why interviewers care

Corporate Intranet interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem Statement: Corporate Intranet as Employee Hub that proves you understand real outages, not happy-path diagrams.

Key Highlights

•sec-001: understanding — Problem Statement anchors ACL-safe search and versioned documents.
•Document versions are authoritative; search and watermarks are derived views only.
•Under load, drop feed personalization before delaying version commit for Problem Statement: Corporate Intranet as Employee Hub.

1	public final class IntranetGuard1 {
2	public boolean canAccess(String companyId, String libraryId, Set<String> adGroups, String requiredRole) {
3	if (companyId == null \|\| libraryId == null \|\| adGroups == null) return false;
4	return adGroups.contains(requiredRole) \|\| adGroups.contains("intranet-admin");
5	}
6	}

1	def principal_bitmap_version(company_id: str, document_id: str, grants: list[str]) -> str:
2	import hashlib
3	payload = f"{company_id}:{document_id}:" + "\|".join(sorted(grants))
4	return hashlib.sha256(payload.encode()).hexdigest()[:16]

1	export interface DocumentVersionRow {
2	companyId: string;
3	libraryId: string;
4	documentId: string;
5	versionId: string;
6	blobKey: string;
7	aclBitmapVersion: string;
8	focus: "problem-statement-corporate-intranet-as-employee-hub";
9	}

Problem Statement: Corporate Intranet as Employee Hub

Engineering notes (problem-statement-corporate-intranet-as-employee-hub)

Why interviewers care

Interview checkpoint

Key Highlights

Section Rescue Kit