security - How to secure/harden an Ansible Machine -

we have bunch of servers, want manage, update , on ansible. there problem, ansible-server needs have root access managed machines.

what measures secure ansible machine or clients, if got security breach attacker not have root access servers?