Question: Secure Appsync API

Hi, this is more of a question than an issue but I can't figure out how to prevent the Appsync Graphql-api from having unrestricted access no matter which client being used.
This is my scenario:
I have a React-client accessing the Appsync graphql API with some queries and mutations. The user is authenticated using Cognito. Running the app works fine, the user can query and update data as expected.
However, the very same user can access the API using a 3rd party app like Postman and send unwanted values to a mutation. These values should be calculated internally by the client application only.
How do I secure this? I.e I only want an authenticated user to be able to access the API using the client.
Thanks in advance

No files, tests, or entry points are named. Start by reviewing the AppSync GraphQL API authentication configuration and Cognito setup described in the issue, then determine how mutation inputs are authorized; done means a documented configuration that preserves authenticated access while rejecting unwanted client-supplied values.

Written by the indexing model from the issue text.