i.e.

Post

has an

Author

field, but the permissions are private so the client can't just write any random

Author

to the post - the server should set that value based on the auth header for the user sending the mutation