Managing state (e.g. presence/absence) in Ansible, any established best practices?
This can be done with two tasks with loops:
# tasks/packages.yml
- name: pkgs | Ensure Good 
  package:
    name: &quot;{{ item }}&quot;
    state: present
  loop: &quot;{{ packages['present'] }}&quot;

- name: pkgs | Ensure Bad
  package:
    name: &quot;{{ item }}&quot;
    state: absent
  loop: &quot;{{ packages['absent'] }}&quot;

This will loop over all of the items in the list that you define and ensure that they are either present or absent.
You could also use a shorthand:
# tasks/packages.yml
- name: pkgs | Ensure Good 
  package:
    name: &quot;{{ packages['present'] }}&quot;
    state: present

- name: pkgs | Ensure Bad
  package:
    name: &quot;{{ packages['absent'] }}&quot;
    state: absent

This would run faster, since you don't have a list of tasks, but a task with a list, but you would lose some visibility into which packages you're actually ensuring the state of.
Caveats:
Ensure that there is no overlap between the two lists. One way would be to make an assertion on the lists before you run the task:
- name: ensure no overlap between good and bad
  assert:
    that: &quot;{{ packages['present'] | intersect(packages['absent'] }} == [] }}&quot;

Also ensure that the lists are not empty.
To answer your final question:

Q: are there best practices about managing the state of &quot;entities&quot; on the configured infrastructure?

It is usually my practice (I wouldn't call it &quot;best&quot;, but take it for what it's worth) to declare the explicit state of a resource. It's quite difficult to do this exhaustively for packages that should be absent - this is something akin to maintaining a &quot;blacklist&quot;. One approach might to be start from a policy and implement specific controls in it. IE for ssh config ensure that protocol v1 is absent, etc.