CORBA35 — passthrough connection

Summary:
I would like to get some clarification on the PASSTHROUGH/Untrusted Proxy
issue.

In page 4-45, the spec says "It is possible to support pass-through through
multiple proxies. For example if in the above example there was another
proxy B2 between B and C, during processing the new_target operation from A,
B can try to establish a pass-through connection to C via a call to
new_target on B2. If this fails, due to NO_PERMISSION for example, B should
fall back to try to connect through B2 using the NORMAL mode.".

If the connection (B - B2) is NORMAL, the whole connection is not a
PASSTHROUGH since the client will see the B2"s identity in the SSL session.
Should B throw back the NO_PERMISSION to the client if B get NO_PERMISSION
from B2 for PASSTHROUGH connection? If the answer is no (seems to me that is
what spec says), does this mean that it is possible that the client request
a PASSTHROUGH connection but actually get a NORMAL connection?