SecurtiyAgent process offload work to SecurityAgentHelper

Projects like Nomad-login (or nowadays Jamf-connect) use to modify the mechanism list in system.login.console authorizationRight. I see that non-privileged mechanisms runs by SecurityAgent process, but it can sometimes delegate another process called SecurityAgentHelper which is an xpc service. I wonder if the role of process SecurityAgentHelper is to serve as fallback to SecurityAgent and under what conditions does it offload task for the helper process. Can someone explain this design to me?