Right now the default is to return everything. In most applications, that can easily bring things to a crashing halt. I believe this should be pretty straightforward once grails/grails-data-graphql#56 is in, but would appreciate any insights others might have.