Not sure how to deal with sysadm yet
I think i do want sysadm to be able use all of systemctl (and the other systemd "ctl" utils for that matter)
systemctl needs to start power units to shutdown (but it should be able to "manage" all units anyways)

systemctl (shutdown -r now) calls askpwdagent which creates the dir and fifo file in /run/systemd with setfscreatecon
if you execute systemctl then you are allowed to rw your own fifo files
systemctl calls less, which reads .lesshst
systemctl: status is for list-units, reload is for daemon-reload
systemctl needs to read state of all daemon (systemctl status $DAEMON)
systemctl set-property --runtime $UNIT ... saves modified unit to /run/systemd/system/

therefore all unit types need to associate with tmpfs