Postfix: How to prepend a header only once?

Just for the record, because I stumbled over this rather old question (because I had a quite similar problem):

There is an easy solution: put your check_sender_access directive into smtpd_data_restrictions.

Explanation: As far as I checked, smptd_relay|recipient|sender|client_restrictions are evaluated once for each recipient of the message, at least if smtpd_delay_reject is set (which is the default and sensible in most cases). Thereby, if you put it in any of these, the header will be prepended once per recipient of the message. Of course, this only works if your condition does not depend on the recipient list of the message.