That was my initial reaction to GraphQL as well, but just like a database you can do stored procedures or you can do SQL but both can still support access contr

That was my initial reaction to GraphQL as well, but just like a database you can do stored procedures or you can do SQL but both can still support access control if you need it. I think it's just a function of them not really thinking too much about the potential sensitivity of the data or building an access control model into the application.