Security
Secure the transport, control introspection, and authenticate and authorize at the field level.
Transport security and introspection control
Serving GraphQL over TLS from framework configuration with generated certificates, each stack's protocol floor, HSTS, public against internal instances, turning off introspection, field suggestions, the IDE and GET, closing the form and text/plain CSRF paths, CORS for one origin, size and token limits, and checking the contract without a public schema.
AuthN and AuthZ
Who is asking and what they may see: Keycloak-issued JWTs validated on both stacks, identity in the context and nothing else, operation rules with annotations and permission classes, ownership enforced at one choke point so every path obeys it, a field rule that fails with a code, and 401 for tokens that do not validate.