docs: private AccessResult checkExceptionDestinationAccess(JsMessage msg,
                                                           ConnectionImpl conn,
                                                           String alternateUser,
                                                           boolean defaultInUse)
      {
          if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
              SibTr.entry(tc, "checkExceptionDestinationAccess", new Object[] { msg,
                                                                               conn,
                                                                               alternateUser,
                                                                               Boolean.valueOf(defaultInUse) });
  
          // Will drive the form of sib.security checkDestinationAccess() that
          // takes a JsMessage
          SecurityContext secContext = new SecurityContext(msg,
                          alternateUser,
                          null,
                          _messageProcessor.getAuthorisationUtils());
          boolean allowed = true;
          boolean identityAdoptionAllowed = true;
  
          if (defaultInUse)
          {
              // We're using the default exc destination for the ME, call
              // checkDestinationAccess() with the default exc dest prefix
              // rather than the fully qualified name
  
              // First we do the alternate user check. If an alternateUser was set then
              // (A )We need to determine whether the connected subject has the authority to
              //     perform alternate user checks. It is assumed that if there is no connection
              //     associated with this call, then we're privileged anyway.
              // (B) We need to do the destination access check with the supplied alternate
              //     user.
  
              if (conn != null)// conn will be null if we've followed the handleUndeliverableMessage route
                               // (privileged) rather than the sendToExceptionDestination route
                               // where the Core SPI has been driven
  
              {
                  // Careful, we need a sec context for the connection rather than that associated
                  // with the message.
                  SecurityContext connSecContext = new SecurityContext(conn.getSecuritySubject(),
                                  alternateUser,
                                  null,
                                  _messageProcessor.getAuthorisationUtils());
                  // Alternate user check
                  if (alternateUser != null)
                  {
                      if (!_messageProcessor.
                                      getAccessChecker().
                                      checkDestinationAccess(connSecContext,
                                                             null, // home bus
                                                             SIMPConstants.SYSTEM_DEFAULT_EXCEPTION_DESTINATION_PREFIX,
                                                             OperationType.IDENTITY_ADOPTER))
                      {
                          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                              SibTr.debug(tc, "checkExceptionDestinationAccess", "not authorized to perform alternate user checks on this destination");
  
                          allowed = false;
                          identityAdoptionAllowed = false;
                      }
                  }
  
                  // Now check access authority on the destination itself
                  if (allowed)
                  {
                      if (!_messageProcessor.
                                      getAccessChecker().
                                      checkDestinationAccess(connSecContext,
                                                             null, // home bus
                                                             SIMPConstants.SYSTEM_DEFAULT_EXCEPTION_DESTINATION_PREFIX,
                                                             OperationType.SEND))
                      {
                          allowed = false;
                      }
                  }
              }
              else // handleUndeliverableMessage route
              {
                  if (!_messageProcessor.
                                  getAccessChecker().
                                  checkDestinationAccess(secContext,
                                                         null, // home bus
                                                         SIMPConstants.SYSTEM_DEFAULT_EXCEPTION_DESTINATION_PREFIX,
                                                         OperationType.SEND))
                  {
                      allowed = false;
                  }
              }
          }
          else
          {
              // Same style of processing as above
              if (conn != null) // conn will be null if we've followed the handleUndeliverableMessage route
                                // (privileged) rather than the sendToExceptionDestination route
                                // where the Core SPI has been driven
              {
                  // Careful, we need a sec context for the connection rather than that associated
                  // with the message.
                  SecurityContext connSecContext = new SecurityContext(conn.getSecuritySubject(),
                                  alternateUser,
                                  null,
                                  _messageProcessor.getAuthorisationUtils());
  
                  // Alternate user check
                  if (alternateUser != null)
                  {
                      if (!_exceptionDestination.
                                      checkDestinationAccess(connSecContext,
                                                             OperationType.IDENTITY_ADOPTER))
                      {
                          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                              SibTr.debug(tc, "checkExceptionDestinationAccess", "not authorized to perform alternate user checks on this destination");
  
                          allowed = false;
                          identityAdoptionAllowed = false;
                      }
                  }
  
                  // Now check access authority on the destination itself
                  if (allowed)
                  {
                      if (!_exceptionDestination.
                                      checkDestinationAccess(connSecContext,
                                                             OperationType.SEND))
                      {
                          allowed = false;
                      }
                  }
  
              }
              else // handleUndeliverableMessage route
              {
                  // Check authority to produce to destination
                  if (!_exceptionDestination.
                                  checkDestinationAccess(secContext,
                                                         OperationType.SEND))
                  {
                      allowed = false;
                  }
              }
          }
  
          AccessResult result = new AccessResult(allowed, identityAdoptionAllowed);
          if (TraceComponent.isAnyTracingEnabled() && tc.isEntryEnabled())
              SibTr.exit(tc,
                         "checkExceptionDestinationAccess",
                         result);
  
          return result;
      }