Field-level permissions in GraphQL - Step-by-Step Execution

Concept Flow - Field-level permissions

Client sends GraphQL query

↓

Server checks user role

↓

Check each requested field

↓

Is user allowed to access field?

No→Exclude field from response

Yes↓

Fetch field data

↓

Build response with allowed fields

↓

Send response to client

The server checks user permissions for each field in the query and only returns data for fields the user is allowed to see.

Execution Sample

GraphQL

query {
  user {
    id
    email
    salary
  }
}

A client requests user id, email, and salary fields; server filters fields based on permissions.

Execution Table

Step	Field	User Role	Permission Check	Action	Response Field Included
1	id	employee	allowed	fetch data	yes
2	email	employee	allowed	fetch data	yes
3	salary	employee	denied	exclude field	no
4	Build response	-	-	include allowed fields only	{id, email}
5	Send response	-	-	response sent to client	{id, email}

💡 All fields checked; salary excluded due to permission denial

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
responseFields	[]	[id]	[id, email]	[id, email]	[id, email]

Key Moments - 2 Insights

Why is the salary field not included in the response even though it was requested?

Because the permission check at step 3 denied access for the 'employee' role, so the field was excluded from the response as shown in the execution_table.

Does the server fetch data for fields the user is not allowed to see?

No, as shown in step 3 of the execution_table, the server excludes denied fields before fetching data to protect sensitive information.

Visual Quiz - 3 Questions

Look at the execution_table, which fields are included in the final response?

A email and salary

B id and salary

C id and email

D id, email, and salary

💡 Hint

Check the 'Response Field Included' column in rows 4 and 5 of the execution_table.

At which step does the server decide to exclude the salary field?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at the 'Permission Check' and 'Action' columns for the salary field in the execution_table.

If the user role was 'admin' with permission to see salary, how would the responseFields variable change after step 3?

A [id, email]

B [id, email, salary]

C [salary]

D []

💡 Hint

Refer to variable_tracker and imagine salary is allowed and included after step 3.

Concept Snapshot

Field-level permissions check each requested field against user roles.
Only allowed fields are fetched and included in the response.
Denied fields are excluded to protect sensitive data.
This happens dynamically per query.
Ensures fine-grained access control in GraphQL APIs.

Full Transcript

Field-level permissions in GraphQL work by checking each field requested in a query against the user's role permissions. The server examines each field and decides if the user can access it. If allowed, the server fetches the data for that field; if denied, the field is excluded from the response. For example, if an employee requests id, email, and salary fields, but salary is restricted, the server returns only id and email. This process protects sensitive information by enforcing access control at the field level dynamically for every query.