Would you mind expanding on this a bit? It seems HGE makes a call to a webhook for every GraphQL query/mutation [1]? This sounds rather expensive to me. Thanks!
[1] https://docs.hasura.io/1.0/graphql/manual/auth/index.html
[1] https://docs.hasura.io/1.0/graphql/manual/auth/index.html
Another deployment pattern is to make everything go through an API gateway which would usually do the auth resolution for all microservices, and thus can set the dynamic variables required for access control for HGE directly too. In this case, auth-webhook is disabled.