You can authenticate your graphQL calls in two different ways,
- Using the API Key
- Login to Sitecore and Impersonate the User who logged in
When you use the API key with your graphQL, basically it impersonates the user which is given in the "Impersonation User" field of the API key. So your query works based on the security & roles assigned to the user entered in "Impersonation User" field in API KEY item.
But when you login to Sitecore using the auth service and invoke the graphQL then the graphQL will use the user who logged in and the query will basically use the roles & security assigned to the user. Refer Sitecore auth services for login.