Authentication can establish the current user from a signed token. The GraphQL context can expose the authenticated user to resolvers and services.

Authorization rules should then determine whether the user can access a project or modify a task. For example, project members may read project data while only project administrators may delete the project.

These checks should be enforced on the server rather than relying on frontend controls.