How do I find out what controls access to a page? I'm surprised by finding that I can't access [some-path] on my site, and I don't know what to do?

Where do I begin searching? What is the fundamental most level to start from?
For Drupal 6 and 7, the basic access check details are stored in the table menu_router.

To find out the relevant details, try a query like

SELECT path, access_callback, page_callback FROM menu_router WHERE path LIKE '%user%';

Lets look at three examples returned by that query on a local site of mine:

| path                | access_callback  | access_arguments   | page_callback
| user                | 1                | a:0:{}             | user_page
| user/%/edit/account | user_edit_access | a:1:{i:0;i:1;}     | drupal_get_form
| user/%/display      | user_access      | "administer users" | ds_contextual_page_tab


The data above has been manipulated slight for brevity.

First: user. userhas an access callback of  1, which means it will always pass. This is not, as one might think, to allow everyone access, but usually rather because the access decisions for this particular path are complicated enough to require more than a regular permission. Because of that, we need to look at the next column, which is page_callback. This tells us which function is called to actually handle the page, and page_arguments, in this case empty, could contain any arguments passed to the same function. In this case, there are no arguments, so we can't learn any more here. One needs to start reading the code of user_page() to figure out more.

Second: user/%/edit/account. This path has a standard access_callback, which means that user_edit_access is called, and if it returns TRUE, we'll be given access. One needs to read that function to find more details.

Third:  user/%/display. This one is the easiest. user_access simply checks if the user has been assigned the permission that is passed in from access_arguments, so in this case administer users. If that permission has been checked for the users role, access will be granted. User 1 automatically gets to bypass such checks.