Start here. This is the direct spoken answer to practice first.
Why this question matters
Activity feeds combine fan-out, privacy, pagination, correction, and retention. The design must keep authorization current while deciding whether feed entries are assembled at read time or projected ahead of time.
I would record activity events when important actions happen, such as created, commented, assigned, uploaded, or status changed. The feed API would return recent events for a user, team, or project with cursor pagination. Each event would include actor, action, target, timestamp, and display metadata. Authorization matters because a user can only see feed items for resources they are allowed to access.