You don’t need a backend team.
You have Postgres.

query LatestPosts {
  posts(
    where: { status: { eq: "published" } }
    orderBy: [publishedAt_DESC]
    first: 10
  ) {
    edges {
      node {
        id
        title
        author { name }
        publishedAt
      }
    }
  }
}

GET /api/v1/posts
  ?filter=status = 'published'
  &sort=-publishedAt
  &page[size]=10

200 OK
{
  "data": [
    {
      "type": "posts",
      "id": "01HW…",
      "attributes": { "title": "…", "publishedAt": "…" },
      "relationships": { "author": { "data": { "type": "authors", "id": "…" } } }
    }
  ]
}

# 1. the agent discovers what this caller may see
{ "name": "describe_schema", "arguments": { "entity": "posts" } }
# → fields, operations, runnable examples — permission-projected.
#   A reader's guide never even mentions createPost.

# 2. then queries with the same filter grammar as REST
{
  "name": "graphql_query",
  "arguments": {
    "query": "{ posts(limit: 10, filterql: \"status = 'published'\", orderBy: [publishedAt_DESC]) { edges { node { id title publishedAt } } } }"
  }
}

query MyProjects {
  projects(
    where: { archived: { eq: false } }
    orderBy: [createdAt_DESC]
  ) {
    edges { node { id name createdAt } }
  }
}
# tenant_id is injected from the caller's claim — never sent by the client.

GET /api/v1/projects?filter=archived = false
X-Tenant-Id: <ignored — injected from token>

# Cross-tenant id?
GET /api/v1/projects/<other-tenant-uuid>
404 Not Found
{ "errors": [{ "status": "404", "title": "Not Found" }] }
# No "forbidden" — never confirm the row exists.

{
  "name": "graphql_query",
  "arguments": {
    "query": "{ projects(filterql: \"archived = false\") { edges { node { id name createdAt } } } }"
  }
}
# tenant_id is injected from the caller's token — the agent
# cannot ask for another tenant's rows, however hard it tries.

{
  "name": "graphql_mutation",
  "arguments": {
    "mutation": "mutation { createProject(data: { name: \"Q3 launch\" }) { id } }"
  }
}
# tenant_id auto-set, audit log written in the same tx.

mutation MarkDone {
  updateTask(
    where: { id: "01HW…" }
    data:  { done: true }
    expectedVersion: 7      # optimistic concurrency
  ) {
    id done _version        # _version is now 8
  }
}

PATCH /api/v1/tasks/01HW…
If-Match: "7"
Content-Type: application/vnd.api+json

{ "data": { "type": "tasks", "attributes": { "done": true } } }

200 OK
ETag: "8"

# Stale write?
412 Precondition Failed
{ "errors": [{ "title": "Version mismatch", "detail": "Expected 7, got 9" }] }

{
  "name": "graphql_mutation",
  "arguments": {
    "mutation": "mutation { updateTask(where: { id: \"01HW…\" }, data: { done: true }, expectedVersion: 7) { id done } }"
  }
}
# writes only run through graphql_mutation — a mutation sent
# to graphql_query is rejected at the wire, before any handler.
# stale expectedVersion? STALE_OBJECT, same as every surface.

query TopRatedVegan {
  products(
    where: {
      tags: { contains: ["vegan"] }
      reviews: { some: { rating: { gte: 4 } } }
      attributes: { $path: ["tier"], eq: "pro" }
    }
    orderBy: [priceCents_ASC]
    first: 20
  ) {
    edges { node { id name priceCents } }
  }
}

GET /api/v1/products
  ?filter=tags contains ('vegan')
    AND reviews ANY (rating >= 4)
    AND attributes__tier = 'pro'
  &sort=priceCents
  &page[size]=20

# Same filter grammar, URL-encoded. attributes__tier is a
# typed JSONB path — declared once, filterable everywhere.
# Compiled to a single parameterized SQL query — no N+1.

# the agent learns the grammar from the schema itself
{ "name": "filter_help", "arguments": { "entity": "products" } }
# → operators + example filters built from the real columns.

{
  "name": "graphql_query",
  "arguments": {
    "query": "{ products(limit: 20, filterql: \"tags contains ('vegan') AND reviews ANY (rating >= 4) AND attributes__tier = 'pro'\", orderBy: [priceCents_ASC]) { edges { node { id name priceCents } } } }"
  }
}

subscription Inbox {
  notificationCreated {         # live, over GraphQL SSE
    id kind body createdAt
  }
}
# Streamed at GET /graphql/stream. RBAC + row filter are
# re-checked at event time — you only receive your own.

query Unread {
  notifications(where: { readAt: { isNull: true } }, first: 20) {
    edges { node { id kind body } }
  }
}

GET /api/v1/notifications?filter=readAt is null&sort=-createdAt

200 OK
{
  "data": [
    {
      "type": "notifications",
      "id": "01HW…",
      "attributes": { "kind": "mention", "body": "…", "createdAt": "…" }
    }
  ]
}

# Live updates aren't REST — they stream over GraphQL SSE:
#   GET /graphql/stream   (Accept: text/event-stream)

{
  "name": "graphql_query",
  "arguments": {
    "query": "{ notifications(limit: 20, filterql: \"readAt is null\", orderBy: [createdAt_DESC]) { edges { node { id kind body } } } }"
  }
}
# row filter enforced — the agent only ever reads the caller's rows.
# Agents run one-shot documents — live subscriptions stay GraphQL/SSE.