I would think you'd need some kind of layer over the database for security, I think managing security at the db level would be very clunky at best. But since t

I would think you'd need some kind of layer over the database for security, I think managing security at the db level would be very clunky at best. But since the idea of GraphQL handles so much from the logic standpoint, your programming layer can just act as a gatekeeper for access. That said, Postgres is pretty powerful. Maybe there is an elegant way to do row-level access control.