Hi Stephan,

At Netflix, teams own both the data store and the API. Any business logic would likely need to be implemented using Graphile's makeExtendSchemaPlugin as described in the article's conclusion. In this example, other services do not call this particular GraphQL schema, but Netflix has robust internal authorization infrastructure used to allow/deny access based on granted permissions. This AuthZ not currently integrated with our Graphile container, but its addition is under consideration.

Notifications based on PosgreSQL's NOTIFY and LISTEN would be a great addition, emitting events based on data changes.