For those that didn't give up on Graphql, like so many of us have desperately wanted to do. This is the correct answer. Shopify should add what permissions you need for each object in the Graphql documentation.