When getting a collection of routes, document how to apply security when getting a collection. But for getting a route item we add a security parameter to metadata which will be over-written if you implement your own. Document how to extend this and use the route voter by adding sprintf("is_granted('%s', object)", AbstractRoutableVoter::READ_ROUTABLE) yourself.