2 ms·This. Your resolvers should still do access control. No different than a REST api would.by holtalanm 5y agoThis. Your resolvers should still do access control. No different than a REST api would.