Regardless of whether the data is retrieved from the loopback server or directly, the id that gets the data has to have access to that database. You can map login ids for the linked server so that the login id for database A maps to the login id for database B, but there's no way I know of to circumvent data access rules to let the login for database A get to data it doesn't have access to without using the database B login somehow.