>What about permissions? What if the logged in user is only allowed to see certain fields? Do I make a table that describes every possible field and which roles can access it?
GraphQL is permission agnostic which allows you to develop your own methods. But there are a lot of nice implementations floating around [1].
>How do I know what's available to query, without reading docs?
Introspection[2].