We put our rolls and permissions in user context, read from the request when it comes in and use that at the resolver level where it is accessible
`property: (parent, args, context, info) => {},
one resource: Authentication and authorization - Apollo GraphQL Docs
Resolvers - Apollo GraphQL Docs