Why is an agentless architecture a practical advantage for operations and security?

There is no agent to install, update or secure, and no extra firewall port to open; Ansible reuses SSH or WinRM, which are already there.

• Nothing to roll out first. You can manage a freshly installed server as soon as SSH works, with no bootstrapping step.
• Nothing to maintain. No agent version to keep in sync with the server software, no daemon that can crash.
• No special network traffic. Managed hosts don't need to allow a non-standard port. The connection is plain SSH (port 22) or WinRM, which are already allowed and audited.
• Smaller attack surface. No permanently running, privileged agent process that could itself have vulnerabilities.

That is why "agentless" is the term that best describes Ansible's architecture, rather than client/server, event-driven or stateless.

Go deeper:

• Connection methods and details (official docs) — how Ansible reuses existing SSH setup: keys, ssh-agent, host key checking.
• Learning Ansible basics (Red Hat) — why no agent on managed machines lowers the barrier and the upkeep.