A user may restart one application service but must not receive a general root shell. What is the best approach?

1. Grant passwordless sudo for all commands
2. Add the user to every privileged group
3. A narrowly scoped sudo rule for the required operation
4. Make the root password available in a public file