Value of GraphQL imho is the ability for the api to be driven by frontend requirements without bothering the backend guys "to expose that one field in that one query".
Once the app is developed I think you might put up reasonable general limits to what queries are responded to in a general manner over the whole api.
Once the app is developed I think you might put up reasonable general limits to what queries are responded to in a general manner over the whole api.