GraphQL: Prevent users seeing entries authored by other users
You can do this using a custom module that adds an authorId condition to element queries, for graphql/api requests.

use Craft;
use craft\elements\db\EntryQuery;
use yii\base\Event;
use yii\web\ForbiddenHttpException;

// ...

// Is this a GraphQL request?
if (Craft::$app-&gt;request-&gt;getActionSegments() == ['graphql', 'api']) {
    Event::on(EntryQuery::class, EntryQuery::EVENT_BEFORE_PREPARE, function(Event $event) {
        // Get the current user
        $user = Craft::$app-&gt;user-&gt;identity;

        // If no one is logged in, return a 403 error
        if (!$user) {
            throw new ForbiddenHttpException();
        }

        // Only Editors are allowed to see everything
        if (!$user-&gt;isInGroup('editors')) {
            /** @var EntryQuery $query */
            $query = $event-&gt;sender;
            $query-&gt;subQuery-&gt;andWhere(['authorId' =&gt; $user-&gt;id]);
        }
    });
}


Note: Since the results will start changing for the same element query depending on who is logged in, you’ll also need to disable the enableGraphQlCaching config setting.