[lwansbrough]

Facebook has a solution for over-fetching, which they call dataloader.

As for the access control problem: it's easily solved with existing features of GraphQL. GraphQL exposes a user context which can be referenced on a per-property basis and thus used to check the permissions of the user.