What sudo does​

Sudo lets an authorized user run a specific command as another user — almost always root — without logging in as that user or ever knowing their password. It checks the request against a policy file, runs the command with elevated privileges if the policy allows it, and logs what happened.

That's the whole job: controlled, audited privilege escalation. Everything else in this post is about how it pulls that off.