Parth Radia

I have all permissions turned off, but when using `fromEvent()` & `.api()` my resolvers are able to circumvent such restrictions.