The failure mode we refuse
Agents on a god-mode control node invent inventory.
Prompt injection still asks for bad ops. Policy has to refuse — topology and allowlists, not vibes.
Without a fabric
- Agent supplies hosts=all and a custom -i
- Free-form command / shell modules
- Every worker is an MCP entrypoint → lateral hop risk
- “Hope the model behaves” as the security model
With ansible-flow-mcp
- Nothing is a target until enrolled (token + SSH identity)
- Hub inventory is source of truth — client -i rejected
- Agent attaches to the hub only; spokes cannot MCP-hop peers
- Module deny list + check-mode default + path-jailed playbooks
Why you need it
You want agents that run Ansible like an operator — not shell as root across the fleet.
Bastion ops you already know
SSH · ForceCommand · fixed inventory
SSH · ForceCommand · fixed inventory