How do you protect a GraphQL API from expensive or malicious queries?

Write or say your answer first, then compare it with the model answer.