How should GraphQL security be designed for production?

For production, authorize resolvers or domain operations, validate inputs, enforce depth or complexity limits, rate-limit expensive operations, use persisted queries where helpful, and avoid exposing sensitive schema details unnecessarily. Add automated tests and observability around the critical behavior, document ownership and failure handling, and review the design when traffic, dependencies, or security requirements change.