If anyone is interested, we've been experimenting a lot with GraphQL directive permissions, and here are the latest findings: https://medium.com/@lastmjs/advanced-graphql-directive-permissions-with-prisma-fdee6f846044