# Allow user lilith to invoke the rail-mitigation script without password
# (fired by apricot-rail-watchdog.service when a rail deviation is detected).
# Scoped to this one command.
lilith ALL=(root) NOPASSWD: /var/opt/apricot-health/sbin/apricot-rail-mitigate
