it doesn't need to be the authorizing party; for example, Gmail checks whether you have access to a Google Doc if you share it