Generally a big DB query is made when the user enters the site or makes the first API request to load all relevant user data. Then the data is stored in a cache

Generally a big DB query is made when the user enters the site or makes the first API request to load all relevant user data. Then the data is stored in a cache system, which will be faster and cheaper than having the user send the data on every request. Most modern web frameworks will do this out of the box with a little configuration. Specifically, I've had good results with Redis, applicable for the majority of web apps. In some rare cases where even local network is too slow, use of local memory storage has worked well (at the cost of greater memory usage and more complex invalidation procedures). But before optimizing user permissions, in my experience there is much more to be gained from optimizing other types of DB queries.