In the classic confused deputy described by Norm Hardy, there are two arguments in the call.  One should use the permissions of the user; the other, the permissions of the deputy.