Nested access maps (I think ;))

7 msg	Postfix 2.2.5 on latest Solaris 9 x86
5 msg	Postfix Relay, and Pop-before-smtp
12 msg	Newb Question
13 msg	Best defense against this?
1 msg	undelivered mail problem - SOLVED
4 msg	Legal local-part
3 msg	virtual_alias_domains with mysql: 'User unknown...
6 msg	Submission port (587): howto to use differente ...
5 msg	When does smtpd_reject_unlisted_recipient kick in?
4 msg	Postfix 'falling back' on sasldb? I don't want ...

Nested access maps (I think ;))
\ FH (21 Sep 2007)
. \ Victor Duchovni (21 Sep 2007)
. \ FH (21 Sep 2007)

3 msg	Suppression of encoding bad header function in ...
4 msg	RE: Catchall ??
3 msg	problem with .forward files + forwarding loops
5 msg	Postfix Strange Behaviours
7 msg	Content filter question, based upon auth'ed or not
28 msg	Mail stuck in active queue for loooong time
11 msg	How to stop a user from changing the 'From:' he...
10 msg	[Semi-OT] blocked port 465, anywhere?
7 msg	chroot problems on Nexenta (OpenSolaris)

Subject:	Nested access maps (I think ;))
Group:	Postfix-users
From:	FH
Date:	21 Sep 2007

I have a couple of email addresses (they are internal mail lists [of the
::include: variety] actually) that I want to restrict who can send email to
them. I thought the best way was to...

main.cf
smtpd_recipient_restrictions =
check_recipient_access hash:/etc/postfix/access

access
maillist permit_mynetworks,check_client_access
hash:/etc/postfix/good_domains,reject

good_domains
domain OK
domain2 OK

But doing this yields a 451 4.3.5 Server configuration error so obviously I
don't know what I'm doing ;) If I remove the check_client_access it works
fine, but the problem is people outside of those listed in "mynetworks" should
be allowed to send mail to these addresses. I know I could set up something
different (like a mailman list) but since there are only a dozen or so people
on these lists it seemed a bit excessive.

Since it doesn't seem possible to nest things like this (or maybe I'm just
doing it wrong), is there any way in postfix to set up this sort of
restriction (limited authorized access to send to a specific destination
address)?

BTW in case it's important I'm running 2.3.8 on a debian 2.6 machine.

TIA