Is there some way to make data available to specific users, but unavailable to others? Basically enforcing an ACL or similar?
Each permission rule can reference a session variable that comes in from your authentication system (whatever it is).
Docs: https://docs.hasura.io/1.0/graphql/manual/auth/index.html
Examples: https://docs.hasura.io/1.0/graphql/manual/auth/common-roles-...