DataLoader solves a major data-access problem, but it does not prevent clients from requesting extremely expensive queries.

A query can contain deeply nested relationships, large lists, aliases that repeat expensive fields, or combinations of arguments that trigger costly database operations.

Production systems can use query depth limits, query complexity analysis, pagination requirements, persisted queries, timeouts, and rate limits to control resource consumption.