> Are things like query depth, width and cost limiting available as parameters to common libraries? No, they are mostly 3rd party utils. I those exist for Apol

> Are things like query depth, width and cost limiting available as parameters to common libraries? No, they are mostly 3rd party utils. I those exist for Apollo server. > Would you follow a similar strategy in GraphQL? Generic auth in a middleware for a user, then specific access management auth inside specific resolvers later on? Yes. Or I would move auth check up a level, and implement schema directive like "@authenticated" or "@hasPerm("perm")" so resolver would do only data resolution, but each approach has advantages and downsides.