Currently, any user with or permission on a content-type can access draft entries by using the parameter (e.g., in GraphQL or in REST).

This makes it difficult to keep unpublished content private, as there's no built-in way to control draft access per role.

### Suggested Solution

It would be great to have a separate permission for accessing draft content, something like "find drafts" or "findOne drafts" in the role settings. This way, admins could decide who can view unpublished content without affecting regular read permissions.

### Use Case

Draft entries often contain work-in-progress content that shouldn't be visible to end users. Currently, anyone with a valid API token or public access can query draft content, which could lead to unintended exposure of sensitive or unfinished information.

### Current Workaround

Currently, the only way to prevent this is by implementing a custom middleware, but this feels like something that should work out of the box. The expectation with Draft & Publish is that content becomes visible once it's published — not before.