How to delimit access to type fields in GraphQL API?

Question

Access rights

There is a GraphQL API with a specific set of types, queries and mutations.
There is authentication: clients from different user groups work with the API.
There is authorization: each group has restrictions on the types of fields they can read (for example, administrators can read all fields of the User type, moderators can read email and nickname, and ordinary users can only read nickname).

What is the "best" way to implement these restrictions according to the GraphQL ideology?

Give different groups different API schemes with different sets of fields in types?
To keep the uniform scheme, but at performance of requests to give in inaccessible fields null'y?
Introduce separate types with their own fields for each group?

The question is more theoretical; I wonder who does what, what are the advantages and pitfalls.