Authorization system using queries as authorization restrictions

An authorization system, comprising:

• one or more processors;
• and
• a memory storing instructions that, when executed by the one or more processors, cause the authorization system to perform operations comprising:
• receiving a first query from a client application;
• determining an authorization context for the first query based at least in part on a set of authorization restrictions corresponding to the client application;
• generating a response to the first query based at least in part on an intermediate response generated by a query engine, the response redacted based at least in part on the authorization context;
• and
• providing the response to the client application.

An authorization system, comprising:

• a GraphQL query engine;
• an authorization rule store storing a set of authorization restrictions associated with a client application;
• and
• a query authorization redactor (QAR) configured to:
• receive a first query from the client application;
• determine an authorization context for the first query based at least in part on the set of authorization restrictions;
• generate a response to the first query based at least in part on an intermediate response generated by the GraphQL query engine, the response redacted based at least in part on the authorization context;
• and
• provide the response to the client application.