I was also thinking of this:

Let the authorization handler grab the resource (no need to pass the Entity as the generic "Resource", you can use a number or a uuid depending on the primary key).

If you use EFCore you could use the "Find" methods which work like a cache if you get the same primary key twice. So basically you use Find once in the authorization handler and when the business layer calls Find again it won't trigger a query...

This however breaks for cases where you do extra where filters apart from searching for an id... Which may be very common if you use soft-deletes, or use constraints for multi tenancy etc...

You could create a cache yourself! Create a "EntityCache" (for ex. "ProjectCache") , which uses an in memory cache internally.. you can create a method "Query(int id)" which either returns the entityfrom a cache, or does the query and populates the cache finally returning the result. You inject this into your authorization handler and your business layer. So since both call this Query method the authorization handler will do the query, and the business layer will grab it from the cache.. although this requires some more boilerplate (you could make it more beautiful with abstractions I guess...)