[dudeinjapan]

Yes, GraphQL is a "contract" in the sense that a blank check is also a "contract".

[arcticfox]

You can whitelist queries in most systems though. In development mode allow them to run whatever query, and then lock it in to the whitelist for production. If that type of control is necessary.