Yes. One example I've used was setting up some non-technical windows users with a shortcut they could click which would: do a key-based, passwordless ssh logi

Yes. One example I've used was setting up some non-technical windows users with a shortcut they could click which would: do a key-based, passwordless ssh login to the server rotate a proxy log, specific to their test machine The logrotate config for these logs included code to move a copy to a mapped network share. So clicking the shortcut caused the log for their most recent bout of testing to magically appear in a folder on their desktop. The sudoers file allowed only this command to be run by these users. They did not get shell access at any stage.