How would you design a notification preference center allowing users to control which types of notifications they receive via which channels?

A preference center models notification types (order updates, marketing, security alerts) and channels (email, SMS, push) as a matrix, with per-user preferences stored typically as a set of boolean flags or an object per notification-type/channel combination -- critically, some notification types (like security alerts about a password change) are often deliberately non-optional regardless of user preference, since allowing users to fully disable security-critical communications introduces its own risk.

// User preference document
{
  userId: '123',
  preferences: {
    orderUpdates: { email: true, sms: false, push: true },
    marketing: { email: false, sms: false, push: false },
    securityAlerts: { email: true, sms: true, push: true }, // not user-configurable
  }
}