sudo, you can write scripts to do things with suid bit set (not necessarily suid root, maybe suid www-data or even suid nobody) and group execute bit set, and allow people to run it by adding them to the appropriate group that owns the script in question.
sudo is better, because it leaves a verbose audit trail and can be quite flexible, though the
sudoers(5) man page is rather human-unfriendly and full of Backus-Naur spaghetti. And
sudo tends to throw up and stop working on any syntax error in /etc/sudoers, so you'd better set yourself a real root password for the time you set up
sudoers file, or you may find yourself locked out with broken
sudo or not
sudo, be very careful when designing scripts, parsing command line arguments, writing to admin-controllable files.
One example, let's imagine you have a script that gets invoked under a privileged account (root or whatever), and by the way it writes with truncation (>) to a file that your admin can replace with a symlink pointing somewhere you never thought of.
Another example, editing /etc/network/interfaces (or an analog of it in your distro) and then ifup'ing an interface may seem innocent, but there are pre/post-up/down scripts that are invoked as root. Oops.