As the man page specifies:
```
Tag_Spec ::= ('NOPASSWD:' | 'PASSWD:' | 'NOEXEC:' | 'EXEC:' |
        'SETENV:' | 'NOSETENV:' | 'LOG_INPUT:' | 'NOLOG_INPUT:' |
        'LOG_OUTPUT:' | 'NOLOG_OUTPUT:')
```
Why don't we use:
```
"options"  ? string  with match (SELF, "^(NOPASSWD:|PASSWD:|NOEXEC:|EXEC:|SETENV:|NOSETENV:)+$") 
```