Before any controller can even be called, the admin area needs to know which user role is allowed to access it, and where in the menu the entry point lives. Both are configured declaratively - no PHP code required.

acl.xml: declaring permissions

Every admin resource (menu item, controller, form field) can be tied to an ACL resource ID. Roles under System > Permissions > User Roles are checked against exactly these IDs. For our practice module, a single node is enough for now:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
    <acl>
        <resources>
            <resource id="Magento_Backend::admin">
                <resource id="Magento_Backend::content">
                    <resource id="Mironsoft_Announcement::announcement"
                              title="Announcements" sortOrder="50" />
                </resource>
            </resource>
        </resources>
    </acl>
</config>

The tree under Magento_Backend::admin is rendered one-to-one as a checkbox tree in the role editor. Where a custom node sits in that tree decides which section an admin sees it under - here deliberately under Magento_Backend::content, because chapter 25 later extends this structure for testimonials with separate permissions for grid, form, and delete.

Binding a controller to ACL

Every adminhtml controller declares, via the ADMIN_RESOURCE constant, which ACL resource ID is required for access:

class Index extends \Magento\Backend\App\Action
{
    const ADMIN_RESOURCE = 'Mironsoft_Announcement::announcement';
    // ...
}

Adding your own menu item

The menu item itself comes from etc/adminhtml/menu.xml and also references the ACL resource ID - if a user isn't authorized for that resource, Magento automatically hides the menu item, no extra logic required.

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Backend:etc/menu.xsd">
    <menu>
        <add id="Mironsoft_Announcement::announcement"
             title="Announcements"
             module="Mironsoft_Announcement"
             sortOrder="50"
             parent="Magento_Backend::content"
             action="mironsoft_announcement/announcement/index"
             resource="Mironsoft_Announcement::announcement" />
    </menu>
</config>

The action value matches the index controller's URL path: frontName/controllerFolder/actionName. The front name comes from etc/adminhtml/routes.xml:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
    <router id="admin">
        <route id="mironsoft_announcement" frontName="mironsoft_announcement">
            <module name="Mironsoft_Announcement" />
        </route>
    </router>
</config>

Making changes visible

bin/magento cache:clean
bin/magento cache:flush

That completes the skeleton: module, table, model triad, ACL, and menu item. Block 2 builds the first grid on top of it.