Hello William,
The explanation for why the changes to those file get undone is: On AEP Conduit, the API code starts up on boot and rewrites the passwd and shadow files so that the users in the database are present. This is legacy from our MTR product (which no longer behaves that way anymore), and is currently being addressed in development. There will be multiple user support (same as MTR) and no rewrites of those files in the future. In addition, I think that sudo will work the way it does on other Linux variants. These updates will be released late Q1 next year or early Q2 (at least that’s what the schedule says).
Jeff