The first thing I look for in these kinds of systems is access control, like Hasura has. Not seeing that here. Is that planned? Did I miss it?
https://graphweaver.com/docs/implementing-authorization
The auth is at the access control is at the API layer.