Using the auth callbacks when registering fields to the Schema.

wp-graphql-auth-callbacks.php

add_action( 'graphql_register_types', function() {

	register_graphql_field( 'RootQuery', 'privateField', [
		'type' => 'String',
		'resolve' => function() {
			return 'some private data';
		},
		'auth' => [
			'callback' => function() {
				return current_user_can( 'edit_posts' );
			}
		]
	] );

	register_graphql_mutation( 'doSomethingPrivate', [
		'inputFields' => [],
		'outputFields' => [
			'somethingPrivate' => [
				'type' => 'String',
			]
		],
		'auth' => [
			'callback' => function() {
				return current_user_can( 'edit_posts' );
			},
			'errorMessage' => __( 'You do not have permission to "doSomethingPrivate"' ),
		],
		'mutateAndGetPayload' => function() {
			return [
				'somethingPrivate' => 'something private'
			];
		}
	] );

} );