Query sever timestamps in GraphQL?

You may find this proposal useful: GraphQL error: Non-nullable field was not present in result from Dgraph - #6 by abhimanyusinghgaur

Notice how you can configure which fields you want in the mutation input and later extending @input to support default values too. So, you will totally be able to configure mutation inputs as per your use-case. Both createdAt and updatedAt can be accomplished that way.

For the part about authentication, I think, that may be taken care of when we support field-level auth as well.