[i6mi6]

You could easily restrict access to different mutations and queries using standard JWT. I'd say restricting parts of a query is a bit trickier because you would have to make explicit checks for the user context when extracting the data you want to be restricted. Other than that, you could pretty much use all kinds of standard authentication as you would use with REST, I've used JWT the most.