How do you implement field-level authorization in GraphQL?

Field-level authorization restricts which fields a user can access based on their role or permissions. The most straightforward approach is checking permissions inside each resolver: if (!ctx.user.isAdmin) throw new ForbiddenError('Access denied'). A cleaner approach uses the schema directives pattern (e.g., @auth(requires: ADMIN)) or a dedicated library like graphql-shield, which lets you define a permission middleware matrix separate from business logic. GraphQL does not automatically enforce authorization — it is entirely the developer's responsibility to implement it at the resolver level, making a consistent authorization strategy critical.