Alby queues all requests and processes them one by one in the same order the NIP07 calls were executed.

The extension also only knows whether to display a prompt or not after checking the site-specific permissions, blocklists, etc.