DataLoader caches belong to the request that defines access

A cached record is not automatically valid for every caller who asks for the same identifier. When access differs by user, sharing a loader cache across requests can return data under the wrong access context.

The DataLoader documentation recommends creating loader instances per request and warns against reusing one instance across requests from different users. Its cache is request-local memoization, not a replacement for a shared application cache. Fetching through the loader must still respect the caller's permissions.

Batching and caching solve different parts of N plus one problem. Batching groups different keys into fewer backend operations; caching avoids loading an already-requested key again. Neither makes a cached value universally shareable.

This supports Authentication does not replace authorization on each request: reducing repeated loads must not turn a result fetched for one caller into authority for another. Keep the loader lifetime aligned with the request context, and treat any broader cache as a separate design with explicit access and freshness rules.