Permissions

Permission	Machine name	Grants
Access frontend editing	access frontend editing	The toggle, the action links and the sidebar. Required for everything else.
Administer frontend editing	administer frontend editing	The settings form and the entity types and bundles form. Restricted.
Add entity references	frontend editing add items	The add before and add after links
Move entity references up and down	frontend editing move items	The move up and move down links
Delete entity references	frontend editing delete items	The delete link
Duplicate entity references	frontend editing duplicate items	The duplicate link
Save and publish changes directly	frontend editing publish directly	The Save and publish button, which saves to the published revision without a draft. Also needs the transition into the published state.

How they combine

A permission on its own is not enough. For any of the four item operations, all of these must hold:

1. The user has access frontend editing.
2. The user has the operation's own permission.
3. The parent field's formatter enables that operation.
4. The user has update access to the host entity, checked by Drupal's normal entity access.
5. The entity being displayed is the latest revision.
6. For content under content moderation, the user may make the transition into the draft state. See Content moderation.

Editing an entity through the sidebar is governed by that entity's own form and access, as it would be in the admin UI. access frontend editing decides whether the link appears; core decides whether the form may be submitted.

Content moderation

Frontend editing saves changes as a draft of moderated content, and does so without the entity form that normally validates the state transition. A user therefore also needs the workflow transition into the draft state, for example use editorial transition create_new_draft in the Editorial workflow, to get the item action links and the paragraph edit link for that content.

frontend editing publish directly adds the Save and publish button to the paragraph form of published content that has no pending draft. The user also needs the workflow transition into the published state, for example use editorial transition publish. Without the permission, the only button is Save, which creates a draft.

To be sent to the draft after a change on the live page, the user also needs view latest version. See Content moderation.

Extending access

Each item operation dispatches an event before it runs, so a module can allow or forbid it per entity. See Events.