Currently any LDAP rule will be applied without any filter to all of the host that Sudo is able to lookup.

It would be very useful to add dynamic filters directly into LDAP.

In example, 
uname -s
output.

In a complex environment, this would really be effective in segregating the environments.

To make a quick example:
sudoFilter: "/usr/local/bin/customcommand"
Which will be applied if exit code is 0, otherwise will not be applied.

Or

sudoFilter: "$(uname -s) == Linux"

This will allow a certain rule to be applied only on Linux AND/OR Solaris AND/OR AIX, ...

The best would be:
sudoFilter: "$(uname -s) == Linux AND $(uname -r|sed -e 's/\.//g'|cut -d "-" -f 1) >= 3160"

In this case, also the syntax has to be defined.