Fine grained access control

schema.graphql

type Post @model
  @auth(rules: [
    # Owner can create, update, delete
    { allow: owner },
    # Authorize group-based access control
    { allow: groups, groups: ["Admin"] }
  ]) {
  id: ID!
  title: String!
  content: String
}