Audience question about authorization patterns in large GraphQL apps: field level vs layer level, how layers coordinate. Speaker: authentication happens once at the controller before execution. Authorization lives at resource (type/model) and field level; graphql-ruby supports both, integrating with Ruby authorization gems like Pundit. Meedan adopted GraphQL so early that such API-layer authorization didn't exist yet, so they enforce authorization one level below (Pundit in the models). The context object available in every resolver typically carries the current user and scope.