Shield fallbackRule

[bombillazo]

Hello,

I am trying to understand how to properly utilize the fallbackRule. If I set it to the deny rule to only allow the specified operations:

export const shieldMiddleWare = shield({
  Query:  rules.isAuthenticatedUser,
  Mutation: rules.isAuthenticatedUser,
},
{
  fallbackRule: deny,
}

Then I get an error because the Shield is running the deny rule on every field resolver of the query/mutation result. It works if I have the option commented out, but then am I exposed to not having rules checking the field resolvers? Can someone query/mutate a field directly by somehow bypassing the Query/Mutation type?