GraphQL resolvers often check the top-level object and skip the nested ones

A common GraphQL setup puts the permission check in the root resolver. project(id: 7) checks that...