Got it. So the above example that I gave with SQL is pretty much the same thing as GraphQL. Assuming you would have a SQL resolver that just like the GraphQL resolver filters out things that should never hit the DB. So GraphQL is a middleware for safely querying the database openly by untrusted 3rd parties. Thanks that explains a lot, it's a pretty interesting idea actually