Where do large backend systems usually validate signup sessions?

From a C / C++ / C# backend perspective:
In large-scale systems, signup requests sometimes fail or sessions get invalidated even when inputs look normal.

Is this typically handled

• inside the auth service,
• by a separate risk/validation service, or
• after account creation via async checks?

Interested in common architecture patterns, not bypass methods.

inside the auth service I think? Wouldnt that be more logical? Maybe someone with more experience could share their point of view.

Well assuming a micro service architecture and this is internal auth service this would fall inside the auth service, there is no reason to have an external risk/validation if they are tightly coupled for user story. This changes of course if it is third party service risk validation but the outbound call would still originate there (or a validation token passed from frontend),