Let's say that you create a sudo rule so that Sylvester can use the systemctl command:

sylvester     ALL=(ALL) /usr/bin/systemctl

This allows Sylvester to have full use of the systemctl features. He can control daemons, edit service files, shutdown or reboot, and every other function that systemctl does. That's probably not what you want. It would be better to specify what systemctl functions that Sylvester is allowed to do. Let's say that you want him to be able to control just the Secure Shell service. You can make the line look like this:

sylvester     ALL=(ALL) /usr/bin/systemctl * sshd

Sylvester can now do everything he needs to do with the Secure Shell service, but he can't shut down or reboot the system, edit service files, or change systemd targets. But, what if you want Sylvester to do only certain specific actions with the Secure Shell service? Then, you'll have to omit the wild card and specify all of the actions that you want for Sylvester to do:

sylvester     ALL=(ALL) /usr/bin/systemctl status sshd, /usr/bin/systemctl restart sshd

Now, Sylvester can only restart the Secure Shell service or check its status.