I've been thinking about this as well and was considering adding a "weight" or "order" attribute that can be used to sort matching responses. This would allow ordering to be preserved when converting a sudoers file into ldif format. It could also be used to prefer authenticated or unauthenticated entries. - todd