I think eventually that's where all of this is going. We're going to have to figure out how to bolt access control onto GraphQL in a better way than we currently do today but that's certainly a solvable problem.
https://docs.hasura.io/1.0/graphql/manual/auth/index.html
PS: I work at Hasura