How do you implement Authorization at the resolver level?

Authorization should verify permissions before returning data or mutating state, typically inside the resolver or a service layer.

While authentication (who are you?) happens in middleware/Context, authorization (can you do this?) belongs in resolvers or domain models. You access the user via context and throw an AuthenticationError or ForbiddenError if permissions are insufficient.