Or just use Strapi, this framework sets up a GraphQL server based on the models defined in your application. You don’t have to do what you described above. In the next version, the GraphQL server will handle permissions on each resolver.