What architecture layer does GraphQL is part of?

I’m currently dealing with a GraphQL project with poor architecture. I read about where to put AuthZ checks and they refer to the “business layer” as to be called from a GraphQL resolver.

Up till now, I thought GraphQL belong in the Data Access Layer (or at least, JUST BEFORE the DAL), but it now looks like it belongs in the most outside layer, similar to a “controller”.

What layer does it belongs to?