Authentication answers who the caller is. Authorization answers what that caller is allowed to do.

A valid JWT does not mean that every field, mutation, or resource should be accessible. For example, an authenticated user may be allowed to read their own profile but not another user's private billing information.

Authorization should therefore be enforced on the server and should not rely solely on hidden fields or frontend restrictions.