Question for DCID Gurus

For those of you familiar with DCID requirements - particularly as pertains to restrictions on `su` capabilities - is the /etc/pam/su entry:

auth required pam_wheel.so use_uid root_only

Generally sufficient to meet those requirements, or does one really need to use:

auth required pam_wheel use_uid