[Freeipa-users] Providing service level access without granting sudo access

Hi All, We have a requirement where we need to give a user access to stop and start a service like tomcat8 without giving sudo access on that machine. I tried adding tomcat8 service (running on an ubuntu host) on the Idm server using "ipa service-add" command. Later, when I tried creating a hbac policy to provide access to a user on that service, it doesn't show up. Is there any other way of providing service level access to a user on Redhat IdM? Please advice. Thanks, Saurabh Garg