This is the default relay control mechanism: 

smtpd_recipient_restrictions = 
   permit_mynetworks 
   reject_unauth_destination 

And hopefully this generally describes how it works: 

       SMTP session 
             | 
             V 
(smtpd_client_restrictions) 
             V 
(smtpd_helo_restrictions) 
             V 
(smtpd_sender_restrictions) 
             V 
smtpd_recipient_restrictions

  permit_mynetworks 
   |   \ 
   |    DUNNO 
   |     \ 
   |      V 
   |   reject_unauth_destination------REJECT-> 
   |           \ 
PERMIT      DUNNO 
   |             \ 
   V              V 
(smtpd_data_restrictions)

This says: (permit_mynetworks) if the client is in $mynetworks, skip any
remaining tests in this restriction stage (smtpd_recipient_restrictions)
and go on to the next restriction stage (smtpd_data_restrictions). 

If the client is not in $mynetworks, let the next test 
(reject_unauth_destination) decide what to do with this 
communication session (in other words: pretend nothing 
happened and continue on). 

So, provided the client is not in $mynetworks, proceed to 
reject_unauth_destination, which says: 
If the message IS addressed to one of the domains I am responsible 
for (domains listed in their proper address class), 
then let the next test in this restriction stage decide what to do 
with the session. As shown, there is no next test in this stage, so 
processing continues on to the next stage (smtpd_data_restrictions). 

If the message IS NOT addressed to one of my domains, then reject it. 
The client will see 'relay access denied'. 

Hopefully this is at least a conceptually accurate description of the 
relay control mechanism. 

Notice how 
permit_* evaluates to PERMIT (OK) or DUNNO 
and 
reject_* evaluates to REJECT or DUNNO 

In order to allow clients that have authenticated via SASL to relay mail
to domains other than those we are responsible for, we add permit_sasl_authenticated
before reject_unauth_destination:

smtpd_recipient_restrictions =    
   permit_mynetworks
   permit_sasl_authenticated
   reject_unauth_destination

# saslauthd Available options in this Debian package:
# getpwent  -- use the getpwent() library function
# kerberos5 -- use Kerberos 5
# pam       -- use PAM
# rimap     -- use a remote IMAP server
# shadow    -- use the local shadow password file
# sasldb    -- use the local sasldb database file
# ldap      -- use LDAP (configuration is in /etc/saslauthd.conf)

• Use the Cyrus saslauthd daemon
• Create Unix accounts and use PAM for user_name/password storage
• Configure SASL on ports 465 (smtps) and 587 (submission)
• Allow PLAIN or LOGIN mechanisms

smtpd_recipient_restrictions =
        permit_sasl_authenticated,
        permit_mynetworks,
        reject_unauth_destination

submission inet n       -       -       -       -       smtpd
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_tls_security_level=may
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
#  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING

$interface_policy{'10028'} = 'SASLAUTH';

$policy_bank{'SASLAUTH'} = {  # authenticated clients
  originating => 1, # declare that mail was submitted by our smtp client
  spam_admin_maps  => ["postmaster\@$mydomain"], # alert of internal spam
  final_spam_destiny => D_BOUNCE, # so the internal sender knows their spammy message
                                  # did not get delivered
  spam_tag2_level_maps => [12], # set tag2 level higher than normal
  spam_kill_level_maps => [12], # set kill level higher than normal
  spam_dsn_cutoff_level_maps => [9999],
  spam_dsn_cutoff_level_bysender_maps => [9999],
  banned_filename_maps => [
    new_RE(
    # block double extensions in names:
      qr'\.[^./]*\.(exe|vbs|pif|scr|bat|cmd|com|cpl|dll)\.?$'i,
    # allow any name or type (except viruses) within an archive:
      [ qr'^\.(Z|gz|bz2|rpm|cpio|tar|zip|rar|arc|arj|zoo|7z)$' => 0],
    # blocks MS executable file(1) types, unless allowed above:
      qr'^\.(exe-ms)$',
    ),
  ],
};

smtp      inet  n       -       -       -       -       smtpd
  -o content_filter=smtp-amavis:[127.0.0.1]:10024
submission inet n       -       -       -       -       smtpd
#  -o smtpd_tls_security_level=encrypt
  -o content_filter=smtp-amavis:[127.0.0.1]:10028
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
#  -o smtpd_tls_wrappermode=yes
  -o content_filter=smtp-amavis:[127.0.0.1]:10028
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING

smtp      inet  n       -       -       -       -       smtpd
  -o content_filter=smtp-amavis:[127.0.0.1]:10024
submission inet n       -       -       -       -       smtpd
  -o smtpd_tls_security_level=encrypt
  -o content_filter=smtp-amavis:[127.0.0.1]:10028
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o content_filter=smtp-amavis:[127.0.0.1]:10028
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING