How do you test authorisation in GraphQL given that one query can traverse the whole graph?

In REST, authorisation is roughly per-endpoint. In GraphQL, one query can traverse deep into the graph:

query {
  order(id: "1001") {       # I'm allowed to see my order
    customer {
      paymentMethod          # ...but am I allowed to see this?
    }
  }
}

If authorisation is only checked at the order entry point, a user could reach sensitive nested fields they shouldn't — the classic GraphQL authz leak (and the second incident in many real post-mortems).

How to test it:

1. Set up two users with different permissions and distinct data.
2. Top-level test: user A cannot query user B's order directly.
3. Nested test (the important one): within a query user A is allowed to start (their own order), assert they cannot resolve a protected nested field — and check whether the response leaks it via data or correctly returns a FORBIDDEN error on that path.
4. Partial-success check: confirm the protected field comes back null with a corresponding error, not silently populated.

The mindset interviewers want: authorisation is a property of every field the query touches, not just the root.