GraphQL

The one authenticated route to the control plane's AppSync API (openspec control-plane/api-access). The inbound policy verifies the caller's Frontegg token against the class's issuer and audience before anything runs; the handler forwards the operation to the API's endpoint carrying the caller's Authorization header unchanged, for AppSync to verify again under its OIDC mode. No role is assumed and nothing is signed on a person's behalf.