When using dovecot container with sieve plugin there is no sendmail to use for sending email for sieve redirect action for example. We can use submission_host instead https://doc.dovecot.org/settings/core/#core_setting-submission_host but there is no way to specify credentials for auth in remote MTA. Submission_relay_* settings e.g. submission_relay_master_user relate to dovecot submission service. Using something like permit_mynetworks in remote MTA is not acceptable for security reasons.
Is it possible to add authorization in the remote MTA using submission_host?
You start the auth service in dovecot, then tell the MTA to use it. For example, if you use postfix this explains how:
https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/