Where should application state live?
Separate document content and lifecycle from temporary application state. The key-value store guide explains provider selection, expiry and concurrency checks, so a local example does not become an untested assumption about a cluster.
How should a customization fit the platform?
Identify the extension point, the consumers that depend on it and the behavior you need to preserve during an upgrade. Keep a small acceptance test beside the customization, including denied access and failure cases.
What belongs at the integration boundary?
Treat authentication, provisioning and authorization as separate decisions. Agree which system owns each one and test the full user journey before considering an integration complete.