How to let user create entity objects
First off, we should define CRUD permissions for your entities in a correct manner. We will have to implement hook_permssion to define each of our crud permissions similar to the following:

function myentitymodule_permission() {
  return array(
    'view my entity' =&gt; array(
      'title' =&gt; t('View my custom entity'),
    ),
    'create my entity' =&gt; array(
      'title' =&gt; t('Create my custom entity'),
    ),
    'edit my entity' =&gt; array(
      'title' =&gt; t('Edit my custom entity'),
    ),
    'delete my entity' =&gt; array(
      'title' =&gt; t('Delete my custom entity'),
    ),
  );
}


The implementation of these newly created permissions should reside in your hook_menu implementation that is responsible for creating the CRUD pages you need.

function myentitymodule_menu() {
  $items = array();
  $items['my-entity/add'] = array(
    'title' =&gt; 'Add my new custom entity',
    'page callback' =&gt; 'myentitymodule_add_page',
    'access arguments' =&gt; array('create my entity'),
  );
  $items['my-entity/%entityid'] = array(
    'title callback' =&gt; 'myentitymodule_page_title',
    'title arguments' =&gt; array(1),
    'page callback' =&gt; 'myentitymodule_page_view',
    'page arguments' =&gt; array(1),
    'access arguments' =&gt; array('view my entity'),
  );
  $items['my-entity/%entityid/view'] = array(
    'title' =&gt; 'View',
    'type' =&gt; MENU_DEFAULT_LOCAL_TASK,
    'weight' =&gt; -10,
  );
  $items['my-entity/%entityid/edit'] = array(
    'title' =&gt; 'Edit',
    'page callback' =&gt; 'myentitymodule_page_edit',
    'page arguments' =&gt; array(1),
    'access arguments' =&gt; array('edit my entity'),
    'weight' =&gt; 0,
    'type' =&gt; MENU_LOCAL_TASK,
    'context' =&gt; MENU_CONTEXT_PAGE | MENU_CONTEXT_INLINE,
  );
  $items['my-entity/%entityid/delete'] = array(
    'title' =&gt; 'Delete',
    'page callback' =&gt; 'drupal_get_form',
    'page arguments' =&gt; array('myentitymodule_delete_confirm'),
    'access arguments' =&gt; array('delete my entity'),
    'weight' =&gt; 1,
    'type' =&gt; MENU_LOCAL_TASK,
    'context' =&gt; MENU_CONTEXT_INLINE,
  );

  return $items;
}


Notice the "access arguments" key of each new page defined in the above function need the array keys of your hook_permission implementation. Please note that you will have to create appropriate page callbacks that (should) reside in inc files in order to do things like render the entity view page and render the creation, edit and deletion pages. These callbacks should (at least) take the ID of the entity as an argument.

If we were to compare your custom entity to that of the node entity, the ID that is used for nodes is the nid. That's why pages like node/321/edit exist and use "321" as that ID argument. I think you want to accomplish more or less the same thing.