1. Does each authenticated request perform only a lightweight Session ID lookup, or does it load the full user record from the database?

2. Is session validation done directly against the database every time, or do you use an in-memory cache (e.g., Redis) or another caching mechanism?

3. If 500 authenticated requests arrive simultaneously, does that mean 500 session validation database lookups before Pre Hooks?

4. If yes, how does NCB prevent the database from becoming a bottleneck at high concurrency? (Caching, connection pooling, indexing, etc.)

5. Is this architecture designed to scale for production SaaS with thousands of concurrent users?