Unless you are very particular about the commands added, most configurations end up being equivariant to ALL. Some examples I've seen: ip, less, vi, tar, cp, m

Unless you are very particular about the commands added, most configurations end up being equivariant to ALL. Some examples I've seen: ip, less, vi, tar, cp, mv, mount, chmod, chown, zip, mysql, dd, ... Any of those and many many more allow for trivial jumping to any command as the target user and you're not improving your security posture compared to ALL, though you make some work harder and some mistakes less likely.