Is it possible to perform attribute-based authorization after the .query?

protectecProcedure
  .input(z.object({
    gradeId: z.string()
  }))
  .query(({ input: {gradeId}, ctx}) => {
    const grade = prisma.grade.findById(gradeId)
    if (result.studentId !== ctx.studentId) {
      throw new Error()
    }
  })

protectecProcedure
  .input(z.object({
    gradeId: z.string()
  }))
  .query(() => prisma.grade.findById(gradeId))
  .use((ctx, result) => {
    if (result.studentId !== ctx.studentId) {
      throw new Error()
    }
  })