What are the effects of the "access commerce administration pages" permission The SA-CONTRIB-2020-020 security patch was titled &quot;Further restrict anonymous user access to anonymous orders.&quot;
Unfortunately it seems to have broken some sites I work on.  We are now seeing access denied errors on admin/commerce/orders/xxx for &quot;semi-trusted&quot; users who have permission &quot;Default: Update orders&quot;.  For these sites the security patch was a non-back-compatible change and I have raised an issue for that.
The solution that worked for me is to grant the semi-trusted users the &quot;access commerce administration pages&quot; permission.
However I am nervous because this permission doesn't seem to have clear documentation.  I don't wish for these &quot;semi-trusted&quot; users to suddenly gain extra access that they should not have such as to edit products.
Please can anyone confirm the effects of this permission?  Does it do nothing alone and only work if other permissions are added?
Does it do nothing alone and only work if other permissions are added?

Currently, yes (although that could theoretically change in the future).
The permission is added to all HTML admin routes for the order entity type (add/edit/etc), and for admin overview pages, which essentially list sub-pages that the user has access to.
If the user doesn't have access to those sub-pages, all provided by separate permissions, they won't see the links, and won't be able to visit them. Similarly, if they don't have the correct entity access permission, they won't be able to perform the respective operation on the entity.