Updated to ensure privileged commands are only added to the audit rules once.