for context we're being asked to come up with an alternative to shutting down the use of sudo on some client machines... we're trying to counter with the ability to audit its use instead