If I pick a random entity and action, what steps can I take (manually if necessary) to see which specific permissions are necessary for CiviCRM to execute an API call with
This doesn't have a completely straightforward answer because sometimes one entity will create another entity with its own set of permissions. Additionally, permissions also get blended with ACLs and custom permission hooks. Finally, the permissions typically happen at the BAO and not API layer.
That said - the best single resource is CRM_Core_Permission::getEntityActionPermissions(). See CRM-20581 for a real-life recent example of how creating an event failed because accessing the StateProvince entity went from being a permission-skipping call to a permission-respecting call.