My managed hosts get a special "for Ansible use only" user account (which has "sudo" privileges) created at installation time. That user is only allowed to log

My managed hosts get a special "for Ansible use only" user account (which has "sudo" privileges) created at installation time. That user is only allowed to log in to those hosts a) with a couple of private keys (i.e., no password authentication allowed) and b) from a few specific (bastion) hosts (controlled via firewall and "Match" rules). A dedicated private CA and short-lived certificates would be "better" but I haven't yet bothered.