that graphql server is where you can handle policy/permissions, and youll have to define a schema and resolvers for that “manually”