how to give a user privilege to run Ansible commands or just an specific tag? for example, I have a tag named 'installagent' and i want to run this command ansible -playbook -i /path  agent.yml --tags installagent from another server via ssh on my Ansible server with user 'testusr'. what should i do?  

can i limit 'testusr' to only use specific tags?
( I read somewhere that i should give sudo permission to that user. if its true what should i do if i don't want to give sudo permission?)
There is no tool in Ansible to authorize a user to execute selected commands or tags only.

It seems a good idea to use sudo to authorize user to execute selective commands.