client_acl with sudo

I have a scenario where I am giving users sudo access to the `salt` command. This avoids having to mess with permissions on the following files and leaves an audit trail to see what users are executing:-

```bash
/var/cache/salt /var/cache/salt/master/jobs /var/run/salt /var/run/salt/master
```

However, even tho users have sudo access to run `salt` I still want to enforce what they can execute using client_acl.

Do you guys think this is reasonable?