is there a way to limit list operations with permissions??

yes -

- operation: User.create
  authenticated: true
  query: permissions/User.graphql:adminRole
- operation: User.read
  authenticated: true
  query: permissions/User.graphql:adminRole
- operation: User.update
  authenticated: true
  query: permissions/User.graphql:adminRole
- operation: User.delete
  authenticated: true

thanks

@roderik I might have misread your question. what are you trying to do with lists?

well when i define a model like Posts, it also creates a query called allPosts

great