---
# Baseline starts audit-only. Opt-in variables are deliberately false by default.
- name: Apply controlled common baseline
  hosts: managed
  become: true
  gather_facts: false
  roles:
    - role: baseline
      tags: [baseline, audit]