Strawberry GraphQL 0.325.0

Apply the Python 3 prompt first. These rules cover Strawberry GraphQL 0.325.0, which requires Python >=3.10,<4.0 and graphql-core>=3.2.0,<3.4.0. Use a maintained Python release and compatible host-framework, server, and optional integration dependencies.

Schema and resolver authorization

• Authenticate in the host framework and build validated principal and tenant state through get_context or FastAPI's context_getter; keep it in Info.context, separate from client variables, extensions, and connection parameters. Supply equivalent trusted context when calling the schema directly.
• Attach BasePermission checks through permission_classes or PermissionExtension to protected fields, mutations, and subscription entry points. Enforce object and tenant authorization in the resolver or service for every returned object and relationship; a permitted parent field does not authorize its children.
• Return an actual bool from every synchronous has_permission, and declare asynchronous checks with async def and run them under asynchronous execution. Never return an awaitable from a plain def permission: on 0.325.0, which predates the 0.326.1 fix, synchronous field resolution never awaits it and counts it as granted, even under Schema.execute(), so the protected resolver runs.
• Use PermissionExtension(fail_silently=True) only when denied access intentionally returns None or [] on a nullable or list field. Preserve denial and audit behavior; neither an empty result, schema directives, nor client-side @skip or @include establishes authorization.