An entry like the following:
would allow user test to run both ls as themselves (the invoking user). When sudo -l is invoked by user test this is shown correctly. But when root runs sudo -U test -l, the output implies user test can run ls as root:
# sudo -U test -l
User test may run the following commands on ip-172-31-28-2:
(root) /bin/ls