How will NPCs work?

How will you make NPCs work? I mean you could go with peer2peer method by using the first client that enters a given cell to manage NPCs but this would become a problem later once all the hackers and script kiddies start fiddling around with what the client sends to the server.

The other way of course is to do everything on the server and just send a representation of the NPCs to the clients. But afaik you cant rip out the navmesh from the world data right? So pathfinding would be a big issue here.
I guess you could go with just defining points in the world manually to use for pathfinding or write some admin tool to automatically send position coordinates to the server from a client you trust and then just run around until the server has enough data to do pathfinding from.

Using navmesh does have its disadvantages too. I don't think you can define jump ares in the navmesh so npcs that could just jump down and get at you, won't. So whenever the client jumps you could mark down a jump start / end position and if the distance between those two points is greater than that of a normal jump on flat ground you could add it into the pathfinder automatically.
This would make NPCs behave a bit more intelligently.

Consider this.
There's a deathclaw chasing after you and you jump down a ledge. How many times has the deathclaw started running around to get to you? It does this every time.
But if you added nodes to the pathfinder dynamically when you jump down the NPC would then be able to jump after you. And since you discard dynamic paths at server reboot (or remove them after 5 minutes) you don't have to worry about false data.

NPCs will be controlled by the server, and we have to get the navmeshes from the ESMs. The data is there, so we can rip it (just like the other stuff we already have in a database). The dynamic addition of pathes sounds interesting!

Very nice idea.
But imo legit jumps should be saved permanently, so the npcs will have some movement variety.
Naturally a server check to know if the jump is legit should be done