For the security comment, I was thinking they were talking about authorization. According to GraphQL, authorization belongs in the business logic layer[1]. A

For the security comment, I was thinking they were talking about authorization. According to GraphQL, authorization belongs in the business logic layer[1]. A lot of projects ignore this advice and put it into the resolvers. This decentralized approach can be difficult to maintain and keep correct. [1]: https://graphql.org/learn/authorization/ https://graphql.org/learn/authorization/