Wow, this is very exciting… hope to try it out soon!
In the official user defaults, I have every user watch all relevant categories by default. If they aren’t in a group which gives them permission to view - they simply don’t get the messages. No problem.
This way, if they are added, they automatically start getting the right messages.
I don’t think it’s important that you have users auto-stop watching categories if they are removed from a group. If they auto-start again when re-added to a group then it’s kinda 6-one-way, 1/2 dozen-the-other, however, the logic as to which groups to remove them from based on what membership could get really ichy if two groups each grant access to a given category, and a user is removed from just one group.