GraphQL mutations describe writes such as creating a transfer or updating a profile. Variables keep values separate from the operation document and let the server validate them against input types.
The schema validates shape, but it cannot decide whether a caller has permission to transfer a particular asset. Authorization and business rules still belong in the resolver or service layer.