How can I delegate authorization logic to the business logic layer in Statamic

1. Define custom authorization logic for GraphQL queries: Statamic allows you to define custom authorization logic for any GraphQL query by providing a closure to the static `auth` method. For example:

php
EntriesQuery::auth(function () {
    return true; // true authorizes, false denies
});

This way, you can implement your own authorization rules, such as checking the user's role or permissions, before allowing access to the query[1].

2. Secure the GraphQL endpoint: Ensure that you have proper authentication and authorization mechanisms in place to secure your GraphQL endpoint. Statamic allows you to control access to the API with API tokens and user permissions[1].

3. Delegate authorization to the business logic layer: It's recommended to delegate authorization logic to the business logic layer, rather than defining it directly in the GraphQL resolver. This helps maintain a single source of truth for authorization and avoids duplication of code[1].

4. Pass a fully-hydrated User object: When implementing custom authorization, pass a fully-hydrated User object to your business logic layer, instead of an opaque token or API key. This allows you to handle the distinct concerns of authentication and authorization in different stages of the request processing pipeline[1].

By following these steps, you can effectively delegate authorization logic to the business logic layer in Statamic, ensuring that your API is secure and access is properly controlled based on your application's specific requirements.