If I wanted to tick boxes when it comes to audits, TBH I would migrate from Ansible to something else where changes get pushed to source control first (before p

If I wanted to tick boxes when it comes to audits, TBH I would migrate from Ansible to something else where changes get pushed to source control first (before push) and nobody has root access during normal operations. I’m using Ansible specifically because I can push directly from my personal machine. I strongly prefer NOT to have passwordless sudo. Disabling root login and then enabling passwordless sudo seems like a pointless exercise in ticking the boxes—any benefit from disabling root login is undone by enabling passwordless sudo.