Entities are powered by the plugin system in Drupal, which means that there is a plugin manager. The default \Drupal\Core\Entity\EntityTypeManager provides the discovery and handling of entities. Both the ContentEntityType and ConfigEntityType entity types and classes extend the base \Drupal\Core\Entity\EntityType class.

The EntityType class constructor provides a default access handler if it is not provided through the \Drupal\Core\Entity\EntityAccessControlHandler class. Every core module that provides an entity type implements this to override at least checkAccess and checkCreateAccess. Meanwhile, the Entity API access handler extends this to support bundle granular permissions and owner-based permissions if an entity implements EntityOwnerInterface in a reusable fashion.

The \Drupal\Core\Access\AccessibleInterface defines an access method, and all the entities inherit this interface. The default implementation in \Drupal\Core\Entity\Entity will invoke checkCreateAccess if the operation is create; otherwise, it invokes the generic access method of the access controller, which will invoke entity access hooks and the class' checkAccess method.

When Drupal generates available permissions, the Entity API module finds entity definitions that define the permission_provider handler and then invokes that class to generate permissions.