I was actually thinking more about passing it as part of the root. For instance, if a person can see all their friends, then you could construct the root for th

I was actually thinking more about passing it as part of the root. For instance, if a person can see all their friends, then you could construct the root for the friend with something like "public only" permission to that person's info, which would prevent someone from accessing private info when checked properly inside the person type. (Although you certainly can use context at the first resolver, it gets less useful the further down you go imo for authorization)