diff --git a/docs/render/using-graphql-schema.md b/docs/render/using-graphql-schema.md
index 8c8b979..e03aaca 100644
--- a/docs/render/using-graphql-schema.md
+++ b/docs/render/using-graphql-schema.md
@@ -42,7 +42,7 @@ apigee-go-gen render apiproxy \
      --template ./examples/templates/graphql/apiproxy.yaml \
      --set-graphql schema=./examples/graphql/resorts.graphql \
      --set-string "api_name=resorts-api" \
-     --set-string "base_path=/graphql" \
+     --set-string "base_path=/resorts/graphql" \
      --set-string "target_url=https://example.com/graphql" \
      --include ./examples/templates/graphql/*.tmpl \
      --output ./out/apiproxies/resorts.zip
@@ -54,7 +54,7 @@ apigee-go-gen render apiproxy \
      --template ./examples/templates/graphql/apiproxy.yaml \
      --set-graphql schema=./examples/graphql/resorts.graphql \
      --set-string "api_name=resorts-api" \
-     --set-string "base_path=/graphql" \
+     --set-string "base_path=/resorts/graphql" \
      --set-string "target_url=https://example.com/graphql" \
      --include ./examples/templates/graphql/*.tmpl \
      --output ./out/apiproxies/resorts.zip
diff --git a/examples/templates/graphql/apiproxy.yaml b/examples/templates/graphql/apiproxy.yaml
index fe50d23..e38de27 100755
--- a/examples/templates/graphql/apiproxy.yaml
+++ b/examples/templates/graphql/apiproxy.yaml
@@ -25,14 +25,16 @@ ProxyEndpoints:
         .name: PreFlow
         Request:
           - Step:
-              Name: GraphQL-Verify
+              Name: CORS-Allow
+          - Step:
+              Name: GQL-Verify
       Flows:
         - Flow:
             .name: graphQLPost
-            Condition: (proxy.pathsuffix MatchesPath "{{ $.Values.base_path }}") and (request.verb = "POST")
+            Condition: (proxy.pathsuffix MatchesPath "/graphql") and (request.verb = "POST")
         - Flow:
             .name: graphQLGet
-            Condition: (proxy.pathsuffix MatchesPath "{{ $.Values.base_path }}") and (request.verb = "GET")
+            Condition: (proxy.pathsuffix MatchesPath "/graphql") and (request.verb = "GET")
         - Flow:
             .name: CatchAll
             Request:
diff --git a/examples/templates/graphql/policies.yaml b/examples/templates/graphql/policies.yaml
index 77a49df..4d8cd9a 100644
--- a/examples/templates/graphql/policies.yaml
+++ b/examples/templates/graphql/policies.yaml
@@ -12,12 +12,25 @@
 #  See the License for the specific language governing permissions and
 #  limitations under the License.
 ---
+- CORS:
+    .continueOnError: false
+    .enabled: true
+    .name: CORS-Allow
+    DisplayName: CORS-Allow
+    AllowOrigins: '{request.header.origin}'
+    AllowMethods: GET, PUT, POST, DELETE, OPTIONS
+    AllowHeaders: '*'
+    ExposeHeaders: '*'
+    MaxAge: 3628800
+    AllowCredentials: true
+    GeneratePreflightResponse: true
+    IgnoreUnresolvedVariables: true
 - GraphQL:
     .name: GQL-Verify
     Source: request
     OperationType: query_mutation
-    MaxDepth: 4
-    MaxCount: 4
+    MaxDepth: 10
+    MaxCount: 10
     Action: parse_verify
     ResourceURL: graphql://schema.graphql
 - RaiseFault: