We have an app running on graphql with 3 different user roles. I'm not sure what other people do but on field resolvers we check for the current users access l

We have an app running on graphql with 3 different user roles. I'm not sure what other people do but on field resolvers we check for the current users access level and see if they should be seeing this thing. If not, the resolvers return errors. In a more elegant approach, we have some of our object types duplicated / inherited. Say, "User" and "UserAdminView". If an admin queries user(id:3) they receive "UserAdminView". If a user does that, they receive a watered down "User" type, which exposes only the fields users can see. UI then selects the appropriate fragment. Maybe there are much better ways though.