`_check_access('foobar', context, data_dict)` looks for a function called `foobar` in `ckan.logic.auth` and returns it. There is an `IAuthFunctions` plugin interface where plugins can register their own string -> auth function mappings, either to add new auth functions or to override existing ones.

The same thing happens with `get_action()` and `IActions`