I'm trying to set up postfix to allow relaying under a limited set of conditions:

• The destination domain is one of a pre-defined list
  -or-
• The client successfully logs in

Here's the relevant bits o' config:

smtpd_sasl_auth_enable=yes
relay_domains=example.com
smtpd_recipient_restrictions=permit_auth_destination,reject_unauth_destination
smtpd_client_restrictions=permit_sasl_authenticated,reject

The problem is that it requires that BOTH restrictions be satisfied, rather than either-or. Which is to say, it only allows relaying if the client is authenticated AND the recipient domain is @example.com.

Instead, I need it to allow relaying if either one of the requirements is satisfied. How do I do this without resorting to running SMTP on two separate ports with different rules?

Note:
The context is an outbound-use-only (bound to 127.0.0.1) MTA on a shared web server which all site owners are allowed to relay mail to one of the "owned" domains (not server-local, though), and for which a limited set of "trusted" site owners are allowed to relay mail without restriction provided they have a valid SMTP login.