How to verify AppSync GraphQL @auth security?

Question

I want to make sure my @auth directive that only allows the user to query for their own documents (owner) is in fact locking down query results correct