Better than writing them in the sudoers language, whose definitions are annotated...