API backend code structure - how to separate authorised and privileged parts of the code

Question

Background

I\'m writing a web API and webhooks (GraphQL for non-webhooks, but that\'s unimportant as that\'s just the outer layer) for a webapp where the vast major