code: public function kernelRequest(GetResponseEvent $event)
      {
          $request = $event->getRequest();
          $entity = $request->attributes->get('_api_resource_class');
  
          if (null === $entity) {
              return;
          }
  
          if (!$this->entityCollection->contains($entity)) {
              return;
          }
  
          $token = $this->tokenStorage->getToken();
  
          if (!$token) {
              return;
          }
  
          switch (true) {
              case 'get' === $request->attributes->get('_api_collection_operation_name'):
                  $attribute = Permission::BROWSE;
                  break;
  
              case 'get' === $request->attributes->get('_api_item_operation_name'):
                  $attribute = Permission::READ;
                  break;
  
              case 'put' === $request->attributes->get('_api_item_operation_name'):
                  $attribute = Permission::EDIT;
                  break;
  
              case 'post' === $request->attributes->get('_api_collection_operation_name'):
                  $attribute = Permission::ADD;
                  break;
  
              case 'delete' === $request->attributes->get('_api_item_operation_name'):
                  $attribute = Permission::DELETE;
                  break;
  
              default:
                  return;
          }
  
          $data = $request->attributes->get('data');
  
          if ($data instanceof Paginator || is_array($data)) {
              foreach ($data as $item) {
                  $vote = $this->voter->vote($token, $item, [$attribute]);
  
                  if (VoterInterface::ACCESS_ABSTAIN === $vote) {
                      throw new LogicException('Voter cannot abstain from voting.');
                  }
  
                  if (VoterInterface::ACCESS_GRANTED !== $vote) {
                      throw new AccessDeniedException('Access denied.');
                  }
              }
          } else {
              $vote = $this->voter->vote($token, $data, [$attribute]);
  
              if (VoterInterface::ACCESS_ABSTAIN === $vote) {
                  throw new LogicException('Voter cannot abstain from voting.');
              }
  
              if (VoterInterface::ACCESS_GRANTED !== $vote) {
                  throw new AccessDeniedException('Access denied.');
              }
          }
      }
docs: Deny access if the user does not have proper permissions
  
  @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event