# Fine-grained command control needed on Ansible task execution **URL:** \ **Category:** Get Help\ **Tags:** policy-as-code, ssh, rhel, python, plugin, security, ansiballz\ **Created:** [July 22, 2025, 12:28pm UTC](https://forum.ansible.com/t/fine-grained-command-control-needed-on-ansible-task-execution/43982 "2025-07-22T12:28:57Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![gunjanpb](https://avatars.discourse-cdn.com/v4/letter/g/ebca7d/32.png) [@gunjanpb](https://forum.ansible.com/u/gunjanpb)\ **Post date:** [July 22, 2025, 12:28pm UTC](https://forum.ansible.com/t/fine-grained-command-control-needed-on-ansible-task-execution/43982/1 "2025-07-22T12:28:57Z")
Hi all, I’m looking for a way to enforce restrictions on what operations Ansible is allowed to execute on target nodes, and prevent certain potentially dangerous or unauthorized operations ( shell commands or other Python-based task operation) from being run, even if they are included in a playbook or role. What I’ve tried so far: - sudoers or shell wrappers etc.: Ansible uses temporary Python files and modules to execute tasks, which makes this option to not work at all. Temporary files bypass traditional command auditing or whitelisting mechanisms. - whitelisting command patterns (in ssh), like: > ‘/bin/sh -c ‘"’"’/usr/bin/python /home/USERNAME/.ansible/tmp/ansible-tmp-NUM.NUM-NUM-NUM/AnsiballZ\_TASKNAME.py && sleep 0’“'”‘’ - This still doesn’t solve the discoverability issue, as the actual commands / operations inside this python files do not undergo any filter. Is there a way to intercept or filter commands before Ansible executes them? Can I hook into Ansible’s execution pipeline to validate or block certain commands / operations ? Are there any plugins, modules, or best practices for enforcing command-level policies? Or is command-level filtering not recommended, and in that case what Ansible-compatible security restrictions exist? Any ideas, or examples would be appreciated! Thanks in advance, Gunjan