Getting authorisation right with GraphQL is no different to getting it right with REST, provided you push the checks down into your data access layer. You could

Getting authorisation right with GraphQL is no different to getting it right with REST, provided you push the checks down into your data access layer. You could do that with e.g. row-level security in Postgres or with something home-baked. The point is that centralising it below the level of the API means everything just works (and anyone adding new endpoints/resolvers doesn't have to remember to "add" authorisation checks).