Routes can define different access requirements through the requirements key. Multiple validators can be added. However, there must be one that provides a true result, or else the route will return 403, access denied. This is true if the route defines no requirement validators.

Route requirement validators are defined by implementing \Drupal\Core\Routing\Access\AccessInterface. Here are some of the common requirement validators defined throughout Drupal core:

• _access: TRUE: Always grants access to the route
• _entity_access: Validates that the current user has the ability to perform
  entity_type.operation, such as node.view
• _permission: Checks whether the current user has the provided permission
• _user_is_logged_in: Validates that the current user is logged in, which is defined with a Boolean value in the routing.yml file