Please insert comments to clarify the authorization scheme.
If the same sa, only one authz call is needed.
Otherwise two calls.