API efficiency and Custom Conditions

No issue. Still querying great. One, hopefully last, question about Graphql…

When I query does it still follow same process? controller->service->query?

So if i have a custom controller that only returns results if the user is the owner of the entry will graphql respect the controller?

and further to it, when I am in a custom code controller can i add to the initial query extra parameters?

for example the initial query from the request is “where _id==XXXX” can i append “AND user==ctx.user.id” so i limit the entries to the authenticated user only???