How to check "access control entry point"

I've created a new custom ACL in OTM to limiting users from accessing objects & actions. There are many standard actions & data objects for which I'm unable to figure out the Entry Point or ACLs.

I tried enabling Tracking Diagnostics but it hasn't been of much help.

For example, when I'm performing upload document action on a Shipment from the custom screen on a custom user role, I get the pop-up where I can select the document but once I click on 'Submit' then OTM throws an error. I need an approach using which I can figure out the exact ACL or Entry Point needed.