As murdockq mentions, the recommended approach is to use GraphQL Bindings to create a lightweight GraphQL server that handles authentication and authorization. The combination of bindings and GraphQL Shield (which is awesome, btw - you should totally use it, even though it isn't maintained by the Prisma team) makes it easy to create and maintain this layer.

The Graphcool Framework uses an approach similar to what Hasura is doing, but there are many use cases where this is simply not flexible enough.