1. Server-side code must remain private. It should only exist on developers' pc and as compiled DLLs on a web server. There should be no way for it to reach the clients. 
2. An Authority Server is the best approach here. I know P2P is working for now, but you guys are doing an amazing job, and soon a wave of game devs (especially from Unity/Godot) will come in wanting to create large-scale multiplayer projects, where P2P just won’t cut it. 
3. There should be replication of data from server to client. I can't explain it technically, but if the server has a Set on some property, then after a change (if we specified it), it should be sent to the same property Set on the client.

•  You create a project and choose a network mode in the settings: Singleplayer (default), P2P, or Authoritative Server. 
•  If you select Authority Server, you can mark necessary classes/methods/properties with the [Server]  or[Replication] attribute. These won’t be included in the client’s dll
•  When building the game, you separation (client logic and server): 
  •  A project.dll, which goes to the Cloud so people can find and play your game on sbox.game. In example: UI, render things, get/local set and etc
  •  A project.server.dll, which stays on your PC and is manually uploaded (via FTP or any other method) to a dedicated server. The server picks it up from, say, a server/ folder. 
•  Inside [Server] methods/classes/properties, you can work with whitelisted methods/classes. Because, realistically, any DLL can be injected into a server to bypass a whitelist, so restricting this too much makes no sense. 
• Other big features might come in later, like 512-1024 player slots, multiple map instances loaded into a single scene, etc.

Final thoughts, this is a huge step for s&box, and I really hope you guys nail it. Once we get private server code, we’ll attract: Investors, Game developers from Unity/Godot who have been waiting for this, People from Rust/GMod/GTA 5 multiplayer communities. Looking forward to any criticism

public static Assembly LoadAssembly(byte[] data)
{
   if (Networking.IsDedicatedServer)
   {
      return Assemly.Load(data);
   }

   return null;
}

dude just described gmod

RPC.Send( Client client, string method )
RPC.Broadcast( string method )
RPC.SendToServer( string method )
RPC.Receive( string method, Action OnReceive )

[Rpc.Server]
public void SomeFunctionRpc(int someArg);

public void SomeFunction(int someArg)
{
        // An internal generated wrapper that call the server function
        Rpc.Call("SomeFunctionRpc", someArg);
}