I have a separate playbook called 'provision' that, among other things, creates an unprivileged user, gives it sudo permissions, disables root login and passwor

I have a separate playbook called 'provision' that, among other things, creates an unprivileged user, gives it sudo permissions, disables root login and password authentication in sshd_config and then restarts ssh. It's the only playbook that uses root. All subsequent connections are made using the unprivileged user and the become directive for privilege escalation. It's a bit awkward, because the playbook can only be run once, but it works in practice.