I recently found something pretty useful in sudo that I wish I new about ages ago. This is especially useful for dotfiles scripts and similar things where you need sudo to do that one thing, like disable the sound effect on boot of an apple device. The problem with regular sudo is that evrything that happens after that will have a sudo session so if some thing that is downloaded from the internet like a package tries sudo in its install script it will just work.
sudo --help the following is printed:
-K, --remove-timestamp remove timestamp file completely-k, --reset-timestamp invalidate timestamp file
This will completely remove the timestamp of the current sudo session. Thus, it is not possible to use together with a command since the command will not be able to run before the timestamp is deleted.
This will invalidate the timestamp by changing it to the finish time of the last command. This means that it can both be used standalone
sudo -k and with a command like
sudo -k apt install sl.