Answer also provided via the GitHub Discussion: https://github.com/strapi/strapi/discussions/8096
In this case, much like REST, you will want to use a policy. You can read more about policies and how to use them with GraphQL here:
https://strapi.io/documentation/v3.x/concepts/policies.html
https://strapi.io/documentation/v3.x/plugins/graphql.html#execute-a-policy-before-a-resolver