This is what simo and I made up in the last few days:
https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOCachingRules
I tried to go to the details so we can avoid further problems.
Please, review it and tell us what is not good or clear enough.
Thanks,
Pavel.