> "sudo foo" could be implemented by asking a privileged daemon to run foo and handing off access to the console to the daemon.

FYI that exists, it's called pkexec (yes, from polkit) :)