Validation doesn't complain about extra command arguments, which means that misspelling an argument will cause it to be ignored.
This allows errors in custom RPC clients to go unnoticed. (The CLI and UI hopefully don't misspell names.)

One such custom client is our test suite: in test_sudorule_plugin we have

api.Command['sudorule_add_user'](self.rule_name, users=self.test_user)

That call does nothing: the parameter name should be user, not users.
(The test itself is passing so far due to an unrelated bug).