Well, it sound like you [think you] need to give root access for someone
to do something, and push it forward by not trusting her.
No, that's not my situation, and doesn't help answer my question, I'm afraid.
I'd still be very grateful for suggestions that do address the question I asked. If you're wondering what sort of general principles might inform your answer, the general principles of user privileges are not the ones I'm interested in; the general principle of hooking into a command so that when it is run it also triggers another command is relevant to my problem. The simple reason I did not ask about this general principle in the first place is that there *might* be some su-specific way of doing it that isn't generally appropriate for other commands. (If so, that's fine, because right now I only really want to know how to do it with su.)
Many thanks in advance,
Sam