Route access checking basics

Simple access checking with permissions/roles

The route data structure allows you to specify permissions and/or roles that are required to access the route.

Multiple access checks

If a route has multiple access checks, the andIf operation is used to chain them together: all results must be AccessResult::allowed() otherwise access will be denied. Returning an AccessResult::neutral() and an AccessResult::forbidden() object does not make any difference. This is different to entity access checks: that one is using orIf and a Neutral result might become Allowed (if there are no Forbidden results but there is an Allowed). See this Drupal core issue for more information about this discrepancy.