@Daniel I read your post and want to answer asap. It’s on my todo.
@BenW true, that wouldn’t be feasible, or secure. We have our own access management implementation that acts as a proxy between the client and Dgraph. However the client is essentially free to query whatever (meaning all DQL features are available)