The question is, should we encourage to use ansible/puppet for this or allow doing this as part of the registration. If so, we should do the same during provisioning.

We can bootstrap puppet agent, so puppet deployed policies can be configured the usual way.

1) register host into a hg with openscap proxy, scap client puppet module and policy
2) puppet agent runs and configures things

For ansible, this is a bit tricky. It would be good to have an ability (checkbox in registration form?) to run ansible roles after host is registered. This would be beneficial not only for openscap - the assumption is that if a user registers a host into hg with ansible roles, the desire is for the roles to be applied to the host.