# Privilege escalation - what is best practice?

**URL:** <https://forum.ansible.com/t/privilege-escalation-what-is-best-practice/24819>\
**Category:** Ansible Project\
**Created:** [June 26, 2017, 8:09am UTC](https://forum.ansible.com/t/privilege-escalation-what-is-best-practice/24819 "2017-06-26T08:09:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Listing](https://avatars.discourse-cdn.com/v4/letter/l/3d9bf3/32.png) [@Listing](https://forum.ansible.com/u/Listing)\
**Post date:** [June 26, 2017, 8:09am UTC](https://forum.ansible.com/t/privilege-escalation-what-is-best-practice/24819/1 "2017-06-26T08:09:02Z")

</div>

Hi all,

I am running my playbooks as user ansible (which has sudo rights) for instance but often need to escalate privileges. This can be done in multiple ways:

1. specify per task: become=true
2. specify for the entire playbook at the beginning: become=true
3. specify for the entire host via the inventory file: ansible\_become=true

Can someone shine some light on this topic about what is best practice here? It is a machine that has to install multiple roles and needs to escalate privilege often, but not always. Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Daniel\_JD](https://avatars.discourse-cdn.com/v4/letter/d/f19dbf/32.png) [@Daniel\_JD](https://forum.ansible.com/u/Daniel_JD)\
**Post date:** [June 26, 2017, 11:19am UTC](https://forum.ansible.com/t/privilege-escalation-what-is-best-practice/24819/2 "2017-06-26T11:19:10Z")

</div>

Hey Listing,

i would say you should use the become method only if necessary. If the the whole play needs it, set it at playbook- level. If one role needs it (all tasks of it), set it at role- level. If only some tasks need it, set it on task- level.  
You don’t want to be the guy/girl who deletes a database or overwrites an important file as root. On 100 Servers.

Less is more!