From my reading of the ansible docs, this won't work right; have you tested this behavior carefully?  All of our playbooks run sudo: true, which is a whole-playbook parameter set from the top. Do you mean for this book to be runnable without that, in which case how can you be creating users? Or do you mean to have it sudo again to some other user for just this task, right? Which I think is the intended use of the remote_user field which will come out in Ansible 1.4.