The agent launcher script lets you start the agent with your own custom command via RHQ_AGENT_START_COMMAND. If you set that to do a sudo, you can tell it to prompt the user for the password to sudo. for example:

RHQ_AGENT_START_COMMAND="su -m test -c '${RHQ_AGENT_HOME}/bin/rhq-agent.sh'"

If you want the user to be prompted, you can tell the launcher script to output the prompt on stdout via:

RHQ_AGENT_PASSWORD_PROMPT=true

However, if this is an agent running colocated on the server, you start the agent via rhqctl. This introduces the problem that stdin isn't redirected to the agent process so none of this prompting works. The user needs to make sure the start command does not require user input during startup.

This probably requires a release notes blurb and some additional documentation.