Yes, this is exactly the hard/interesting part to implement. Facebook uses their...

dgreensp on July 2, 2015 | parent | context | favorite | on: GraphQL Working Draft

Yes, this is exactly the hard/interesting part to implement. Facebook uses their own graph databases which lets you specify access control rules. You'd need something similar on top of SQL.