Security & Abuse Control

Rank candidate controls by what each phase knows, what each costs on every legitimate request, and how certain each rejection is. Push size, rate and content-type outward, keep document-shaped limits in the service, and treat execution deadlines as the backstop nothing static can replace.

Make the default deny rather than allow, so an unmarked field fails a build check instead of shipping open; require an explicit, reviewed exception list for genuinely public fields; and prove enforcement with denial tests and denial metrics rather than with schema review.

Separate visibility from authorization. What executes is decided by checks at execution for every audience; what a published schema shows is a contract decision, and a field a partner can see is one you must deprecate rather than delete.

No. The GraphQL specification describes one request carrying one document and never mentions HTTP, and the GraphQL over HTTP working draft describes a single request per HTTP request. Array batching is a widespread convention, not a specified feature.

If a forbidden record produces an error entry at that field's path while a non-existent one produces a plain null, the difference answers a question the caller was never authorized to ask. It matters when identifiers are guessable or enumerable.

For as long as the server chooses — nothing revokes it automatically. Authorization can be checked when the connection is established, again for each subscribe, and again per delivered payload; only the last catches a credential that expires mid-stream.

Run in log-only mode until the miss log holds no legitimate callers, then enforce. Tie document retention to the client-version support window rather than a fixed timer, scope the set per client, and keep an audited operator escape hatch.