sudo authenticates the caller with their own password and then consults /etc/sudoers to decide what they may run — which is what makes it auditable and revocable per user. su needs the target account's password, so it cannot be delegated, and sg and newgrp switch group identity rather than user.
Official docs