This is what simo and I made up in the last few days: https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOCachingRules I tried to go to the details so we can avoid further problems. Please, review it and tell us what is not good or clear enough. Thanks, Pavel.