No, I mean of whitelist of full GraphQL queries with string/number arguments, where you can only run one of the queries in the whitelist, and the client can only choose which query and the string/number values, but not submit an arbitrary query string.
That's already how it works, it is not an open ended SQL query. The GraphQL schema is the whitelist.