I'm trying to define an access control handler for a custom entity, and as far as I can tell it's never being called.

Here's my entity header:

  /**
   * Defines the Target entity.
   *
   * @ContentEntityType(
   *   id = "target",
   *   label = @Translation("Target"),
   *   label_collection = @Translation("Targets"),
   *   label_singular = @Translation("Target"),
   *   label_plural = @Translation("Targets"),
   *   label_count = @PluralTranslation(
   *     singular = "@count Target",
   *     plural = "@count Targets",
   *   ),
   *   handlers = {
~_ *     "access" = "Drupal\nm_base\TargetAccessControlHandler",
   *   },
   *   base_table = "nm_target",
   *   admin_permission = "access submissions",
   *   entity_keys = {
   *     "id" = "uuid",
   *   }
   * )
   */
  class Target extends ContentEntityBase {

And here's my access controller:

<?php

namespace Drupal\nm_base;

use Drupal\Core\Access\AccessResult;
use Drupal\Core\Entity\EntityAccessControlHandler;
use Drupal\Core\Entity\EntityHandlerInterface;
use Drupal\Core\Entity\EntityInterface;
use Drupal\Core\Entity\EntityTypeInterface;
use Drupal\Core\Session\AccountInterface;
use Symfony\Component\DependencyInjection\ContainerInterface;

/**
 * Defines an access controller for the target entity.
 *
 * @see \Drupal\nm_base\Entity\Target.
 */
class TargetAccessControlHandler extends EntityAccessControlHandler implements EntityHandlerInterface {

  /**
   * {@inheritdoc}
   */
  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
    devel_debug('check_access');
    return AccessResult::allowedIf(false);
  }
}

Executing an entity query as a non-admin user never triggers that devel_debug. What am I missing?