It's good practice to check user permissions in the service despite
this check has been performed somewhere else (here GraphQL mutation).