Major Description
As part of discussions, it is better that every mutation either Put/Delete with Visibility expressions should validate if the expression has labels for which the user has authorization. If not fail the mutation.
Suppose User A is assoicated with A,B and C. The put has a visibility expression A&D. Then fail the mutation as D is not associated with User A.