How would you answer an interview scenario involving GraphQL queries and mutations?

In an interview, I would first define GraphQL queries and mutations and the problem it solves, then explain how I would keep resolver responsibilities clear, validate mutation inputs, authorize at the correct boundary, control query cost, and return only schema-approved data. I would also call out the main failure mode: treating GraphQL as unrestricted database access can expose excessive data, create expensive queries, and bypass business authorization rules. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.