> such as a certain user can only see public fields of other users In Graphql, the solution is usually to return `null` for restricted field. This is arguably

> such as a certain user can only see public fields of other users In Graphql, the solution is usually to return `null` for restricted field. This is arguably better security than raising unauthorized exception, since attacker can't differentiate having no permission to having no data. > You can only change your vote after 10 minutes This in done in mutable action, which can have permission check inside.