i have a very general question, given prisma generates my resolvers, how do i control the permissions?

Prisma doesn’t generate your resolvers. Prisma generates an extensive, but basic, CRUD api and you’re expected to write your own resolvers on an application server.

Have a look at graphql-shield.

I'm using graphql-shield