Using the Graph Manager and Operation Registry with external clients/customers

Hello Apollo,

I was wondering if there are any ideas on the drawing board about how to support a workflow for exposing a graph to external users/clients, making sure they only perform sane queries?

**A concrete example**
We, company A, build an awesome API and use the Apollo tooling and platform to do it. Our customers, companies B and C, would like to integrate some of their systems with our API. We use the operation registry internally to make sure only sane and quick queries are executed against our schema. We would like it if there was some way that we could 'approve' of our customers' queries before they are executed against our production environment somehow. Perhaps the Graph Manager could estimate their resolve time, and we could set up a rule for how much a query is allowed to 'cost'?

_Statistics and billing_
Maybe this could also allow for API key usage statistics for graphs, which would allow us (company A) to bill our customers for API usage based on either number of requests or seconds of servertime used.

___________________________

This would of course require a separate login than Github organisations, as well as some role based authorization rules for API keys, so the customer companies won't have admin access to the graph.

What are your thoughts on this - is this something you could image the Graph Manger supporting, or should we find other tooling for these purposes?

The issue names no files, tests, or entry points. Start by clarifying the intended Graph Manager and Operation Registry workflow for external clients, including query approval, cost limits, usage billing, separate login, and role-based API-key authorization, before identifying an implementation entry point.

Written by the indexing model from the issue text.