Sudo would be a very cool feature. How about a package (sudo) that keeps a table of urls to protect. Hook into the request processor so that if you go to one without an valid sudo session you are redirected just like the current session system. You could control the time with a package parameter. You could also specify that a url requires login even with a valid sudo session. The urls could have wild cards and package-keys.
package-key url single_P * */admin/* f would protect all admin pages * */permission t would require login to every access acs-subsite /admin* f would protect the subsite admin pagessorry about the formating
This would allow sites to customize security policies without changing code just like sudo.