It's as correct as you make it. Architecture questions don't have
straightforward answers. I suppose your cache would be another layer if you
chose to impliment it as another (security) tier after UI but before BL or
you could incorporate it into the UI layer. It depends.

I would use this as a security tier (ST- since we are bent on using
acronyms) where user authentication is done. This tier would sit behind the
UI tier. That is just one approach though for obvious reasons their may be
different approaches.