Add authorization to a GraphQL API with a custom directive and Oso, an open source authorization library, to control who can act on which resource.