NOTBEFORE is a sudoers date constraint that defines the earliest time a rule may be used. If a command entry includes NOTBEFORE, sudo should only authorize it once the current time is at or after that threshold. It is commonly paired with NOTAFTER, which sets the closing time for the same rule.
This matters because time-based authorization is part of the security policy, not just scheduling. In attacks, a local user may try to influence how privileged software interprets time or timezone data so a rule appears valid too early or too long. Defenders reduce that risk by using explicit time zones or UTC, limiting inherited environment variables, and reviewing sudoers entries that rely on dates. When time controls are precise, they can safely support maintenance windows and temporary access grants.