Kong seems to have some offerings on the API gateway security front for GraphQL https://konghq.com/blog/engineering/graphql-authorization-at... I haven't looked at it very closely yet, but I'm wondering Kong for other reasons (unrelated to GQL)