Running Only What You Need
A complete site playbook might include roles for OS hardening, package installation, configuration deployment, and monitoring setup. Running all of this on every change is slow and risky — if you're only updating a configuration file, you don't want to re-run the package installation tasks.
Tags let you label tasks, roles, or entire plays, then selectively run only the labeled portions — a role can carry security/baseline tags, another deploy/app, and individual tasks their own tags like config or monitoring. A playbook run can then be scoped to just one tag, to everything except a given tag, to a combination of several tags, or simply asked to list every tag that exists in the playbook without running anything at all. Two special built-in tags exist: always (task runs regardless of --tags filter) and never (task only runs if explicitly requested with --tags never). The never tag is useful for destructive or debug tasks you want available but not accidentally triggered.