We take a slightly different approach at hasura. Every table/view (node) has declarative permissions defined. These are Boolean constraints that can use any pro

We take a slightly different approach at hasura. Every table/view (node) has declarative permissions defined. These are Boolean constraints that can use any property in the graph. The GraphQL data layer then ensures that the generated SQL query is intersected with those constraints for every node being resolved. This is works out well for performance also because you don’t have to proxy to the GraphQL proxy.