Looking at search.routing.yml, I noticed it contains the following code.
entity.search_page.enable:
path: '/admin/config/search/pages/manage/{search_page}/enable'
defaults:
_controller: '\Drupal\search\Controller\SearchController::performOperation'
op: 'enable'
requirements:
_entity_access: 'search_page.update'
_csrf_token: 'TRUE'
entity.search_page.disable:
path: '/admin/config/search/pages/manage/{search_page}/disable'
defaults:
_controller: '\Drupal\search\Controller\SearchController::performOperation'
op: 'disable'
requirements:
_entity_access: 'search_page.disable'
_csrf_token: 'TRUE'
While it's clear that the first part of the _entity_access value is the ID of the configuration entity used in the annotation for the class implementing it, I don't understand what I can use as part after the dot. Is it restricted to a set of values (e.g. add, update, use, delete), or is it a value the access controller class for that entity handle?