Set access restriction for baseroute
This might work

if (($route = $collection-&gt;get('entity.example.canonical'))) { // base_route
      $current_route = \Drupal::routeMatch()-&gt;getRouteObject(); // get current route
      $current_route-&gt;setRequirement('_role', 'administrator');
}