Which command runs one command as another user, authenticating with the caller's own password?

Why this is the answer

sudo authenticates the caller with their own password and then consults /etc/sudoers to decide what they may run — which is what makes it auditable and revocable per user. su needs the target account's password, so it cannot be delegated, and sg and newgrp switch group identity rather than user.