[Model] New recipients can without reencrypting content [Server-Side Access Control] yes, only new (X)ACL [Subtree encryption] depends on situation [Pool encryption] 
yes
p o s s i b l e
y e s
n o
n e e d s s o m e s o r t o f s t y l e s h e e t