Another way to say this is: PostGraphQL exposes as an api whatever it sees in the specific database schema. It's your job to show it only the stuff it's suppose

Another way to say this is: PostGraphQL exposes as an api whatever it sees in the specific database schema. It's your job to show it only the stuff it's supposed to expose and there is a lot of flexibility in the database available to help you do just that (role system, views, stored procedures, RLS, constraints).