Design a system to recommend to a signed-in enterprise user the next files they are most likely to open in a productivity suite. Cover: (1) key signals (view/edit history, co-edit graph, recency, device context, calendar/email cues) and safe feature engineering; (2) candidate generation (collaborative filtering from access logs, content embeddings, organizational graph) with strict access-control filtering before ranking; (3) ranking architecture (feature store, online inference, latency budgets, cold-start for new users/files, time-decay, diversity/novelty); (4) preventing data leakage across tenants and enforcing ACLs/row-level security end-to-end; (5) privacy/security hardening (minimizing PII, encryption, on-device personalization options, differential privacy or coarse logging); (6) feedback loops and bias control (propensity, popularity bias, freshness); (7) explainability, fallbacks when models fail, and disaster recovery. Provide a verbal architecture diagram, API contracts for candidate/feature services, expected p99 latencies, and a plan for safe rollout.