I did something similar with password resets. Create a procedure owned by sys that does what you want; grant execute on that procedure to the user.

I would add some check in the procedure, so they can't kill just any session - like only if the username is in a certain list/table, or user profile, etc.

Just curious, why does someone need to kill sessions? Sounds drastic...