Permissions can be defined by a module programmatically or statically in a YAML file. A module needs to provide a permission_callbacks key in its permissions.yml that contains either an array of classes and their methods or a procedural function name.

For example, the Filter module provides granular permissions based on the different text filters created in Drupal:

permission_callbacks: 
- Drupal\filter\FilterPermissions::permissions 

This tells the user_permissions service to execute the permissions method of the
\Drupal\Filter\FilterPermissions class. The method is expected to return an array that matches the same structure as that of the permissions.yml file.

An example of using generated permissions will be covered in Implementing custom access control for an entity recipe of Chapter 10, The Entity API.