For example, in the following query, can id have a permission query that fails, while course has a permission query that passes, and can the result be just the course data?

Required fields cannot return null, in that case null-bubbling kicks in and the parent will become null. For optional fields, you should get the data, along with an 'Insufficient Permissions' error, that you can choose to ignore.

It looks like if you request one field that you don't have permissions for, data is null and none of the other fields return, even if you have permissions for them

Like I said, if the field is required that is the behavior

Sorry, now I understand

If I have:

type Link implements Node {
  url: String
  description: String
}

With permission only on url field; And query:

query{
  allLinks { url description }
}

I get:

{
  "data": {
    "allLinks": [
      {
        "url": "<http://test.com>",
        "description": null
      }
    ]
  },
  "errors": [
    {
      "locations": [
        {
          "line": 2,
          "column": 18
        }
      ],
      "path": [
        "allLinks",
        0,
        "description"
      ],
      "code": 3008,
      "message": "Insufficient Permissions",
      "requestId": "eu-west-1:simple:cj76y0kcezkhz0196djoow1ue"
    }
  ]
}

If I use this schema:

type Link implements Node {
  url: String!
  description: String!
}

And run the same query, I get:

{
  "data": null,
  "errors": [
    {
      "locations": [
        {
          "line": 2,
          "column": 18
        }
      ],
      "path": [
        "allLinks",
        0,
        "description"
      ],
      "code": 3008,
      "message": "Insufficient Permissions",
      "requestId": "eu-west-1:simple:cj76y1pr4zhse0139fbrz160o"
    }
  ]
}

And that's desired because with GraphQL, if you get back data any data at all, you should get the types specified, correct?

That's because

null

is not a valid value for a required field, so it cannot be returned.