Décrire les permissions dans le fichier mymodule.permissions.yml :

mymodule.permissions.yml

access my module content:
  title: 'Access my module content'
  description: 'This gives access to the content of my module'
administer my module:
  title: 'Administer my module'
  description: 'Access my module administrative settings page'
  restrict access: true

Associer des permissions à des routes :

mymodule.routing.yml

mymodule.content:
  path: '/mymodule'
  defaults:
    _controller: '\Drupal\mymodule\Controller\FirstController::content'
    _title: 'My First page and Menu Item'
  requirements:
    _permission: 'access my module content'