diff --git a/config/sudoers.d/bash-scripts-network-tools b/config/sudoers.d/bash-scripts-network-tools
new file mode 100644
index 0000000..71b41cb
--- /dev/null
+++ b/config/sudoers.d/bash-scripts-network-tools
@@ -0,0 +1,21 @@
+# Sudoers policy for bash-scripts network-monitoring tools.
+#
+# This exists so operators of live_network_monitor.sh don't need blanket
+# sudo rights just to run one script. It scopes passwordless root access
+# to exactly the two tcpdump invocations that script uses (packet capture
+# to /dev/null, and a 1-packet count), for members of the "netmon" group
+# only. vnstat is not listed here — the script runs it without sudo.
+#
+# Install (as root, after review):
+#   visudo -cf config/sudoers.d/bash-scripts-network-tools
+#   install -m 0440 -o root -g root \
+#     config/sudoers.d/bash-scripts-network-tools \
+#     /etc/sudoers.d/bash-scripts-network-tools
+#
+# Add operators to the group: usermod -aG netmon <username>
+#
+# Adjust the binary path below to match your distro if `command -v
+# tcpdump` resolves elsewhere.
+
+%netmon ALL=(root) NOPASSWD: /usr/sbin/tcpdump -i * -w /dev/null
+%netmon ALL=(root) NOPASSWD: /usr/sbin/tcpdump -i * -c 1
diff --git a/scripts/install-sudoers-policy.sh b/scripts/install-sudoers-policy.sh
new file mode 100755
index 0000000..d64a979
--- /dev/null
+++ b/scripts/install-sudoers-policy.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+set -euo pipefail
+
+# Installs the scoped sudoers policy for live_network_monitor.sh so its
+# operators don't need blanket sudo rights — only rights to run tcpdump
+# and vnstat with the exact arguments that script uses. This is an
+# explicit administrative action: it is never invoked automatically by
+# any other script here, and it always validates with visudo before
+# touching /etc/sudoers.d.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(git -C "$SCRIPT_DIR" rev-parse --show-toplevel 2>/dev/null || echo "$SCRIPT_DIR")"
+# shellcheck source=/dev/null
+source "$REPO_ROOT/lib/audit_log.sh"
+
+POLICY_SRC="$REPO_ROOT/config/sudoers.d/bash-scripts-network-tools"
+POLICY_DST="/etc/sudoers.d/bash-scripts-network-tools"
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "This script must be run as root (it writes to /etc/sudoers.d)." >&2
+    exit 1
+fi
+
+if [ ! -f "$POLICY_SRC" ]; then
+    echo "Policy file not found: $POLICY_SRC" >&2
+    exit 1
+fi
+
+echo "Reviewing policy before install:"
+echo "---"
+cat "$POLICY_SRC"
+echo "---"
+read -rp "Install this policy to $POLICY_DST? [y/N] " confirm
+if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
+    echo "Aborted, nothing installed."
+    exit 1
+fi
+
+if ! visudo -cf "$POLICY_SRC"; then
+    echo "Refusing to install: policy failed visudo syntax check." >&2
+    audit_log "install-sudoers-policy.sh" "install" "$POLICY_DST" 1
+    exit 1
+fi
+
+install -m 0440 -o root -g root "$POLICY_SRC" "$POLICY_DST"
+audit_log "install-sudoers-policy.sh" "install" "$POLICY_DST" 0
+
+echo "Installed. Add operators with: usermod -aG netmon <username>"
diff --git a/src/networking-tools/live_network_monitor.sh b/src/networking-tools/live_network_monitor.sh
index 75f3268..a1276ee 100755
--- a/src/networking-tools/live_network_monitor.sh
+++ b/src/networking-tools/live_network_monitor.sh
@@ -36,7 +36,11 @@ cleanup() {
 # Trap the SIGINT (Ctrl+C) signal to clean up properly
 trap cleanup SIGINT
 
-# Start tcpdump in the background to monitor packets
+# Start tcpdump in the background to monitor packets. Requires either
+# full sudo rights or membership in the "netmon" group under the scoped
+# policy in config/sudoers.d/bash-scripts-network-tools (see
+# scripts/install-sudoers-policy.sh) — the latter is preferred so
+# operators don't need blanket root access just to run this script.
 sudo tcpdump -i "$INTERFACE" -w /dev/null &
 
 # Start vnstat in live mode in the background