在GraphQL服务器中实现访问控制的好方法是什么？

Background:

I have a set of models, including a User and various other models, some of which contain references to a User. I am exposing these models for querying via a GraphQL API generated by I have a set of models, including