GraphQL introspection is extremely useful during development because tools can discover the schema automatically. Production policies vary depending on the environment and threat model.

Disabling introspection is not a substitute for authentication or authorization. If introspection is restricted, clients and internal tooling should still have a controlled way to access the schema they legitimately need.