Starting point
Separate shared and private collections, test an export path, and record how a departing member is removed.
Workflow boundary
Define whether a member removal affects shared events, address-book visibility and recovery exports.
Resource boundary
Grove is a starting catalogue allocation to evaluate: 2 vCPU, 4 GB RAM, 60 GB SSD and 2 TB monthly transfer. Measure the actual application; no service count or performance result is implied.
Ownership
Give members application accounts, keep host administration limited, and identify a backup maintainer.
Recovery outcome
Complete the recovery kit and test a separate restore before relying on the design.