Elicitation is the MCP mechanism that pauses a task and asks a person for information or confirmation. It is the protocol’s only built-in human checkpoint, but it still requires external controls to ensure the responder is the same person who started the flow and that the answer is recorded accurately.
Expanded Definition
Elicitation in Model Context Protocol is the protocol moment when an AI Agent pauses execution and requests a person’s input, approval, or missing detail before continuing. It matters because the human response is part of the task flow, not an out-of-band chat. In practice, that makes elicitation a control point for authorization, exception handling, and data quality, but it does not by itself prove who answered or whether the response was genuine.
Definitions vary across vendors on how much state must be preserved during the pause, how long the request remains valid, and what metadata should be attached to the answer. NHI Management Group treats elicitation as a protocol-level interaction that still requires identity binding, tamper-evident logging, and replay resistance. That places it closer to a governed approval step than a casual prompt for clarification, and it should be assessed alongside NIST Cybersecurity Framework 2.0 functions for protect and detect.
The most common misapplication is treating elicitation as a built-in trust guarantee, which occurs when teams assume the protocol’s pause alone confirms the responder’s identity and integrity.
Examples and Use Cases
Implementing elicitation rigorously often introduces workflow friction, requiring organisations to balance safer approvals against slower task completion and more complex session handling.
- An AI Agent requests a manager’s confirmation before submitting a reimbursement claim above a set threshold, while the platform separately verifies the responder’s session and records the decision.
- A support automation flow pauses to ask a user whether it may disclose a ticket summary to a third-party system, with the approval logged as part of the service-account action trail.
- A deployment assistant halts when a requested change exceeds policy and uses elicitation to capture an exception approval, then resumes only after an authenticated response is attached.
- An onboarding agent asks for a missing business unit or cost center before provisioning access, reducing downstream corrections while preserving an audit record.
- NHIMG’s Ultimate Guide to NHIs is useful background when elicitation is used to protect service-account actions that depend on human approval; this should be paired with the identity assurance expectations described in NIST Cybersecurity Framework 2.0.
Why It Matters in NHI Security
Elicitation is important because many NHI failures are not caused by the absence of a human checkpoint, but by weak control around that checkpoint. If a response can be spoofed, replayed, misattributed, or altered after submission, the AI Agent may treat an untrusted answer as policy approval. That creates a governance gap between protocol convenience and operational assurance.
This gap becomes more serious in environments where NHIs already carry excessive privilege or where visibility into service accounts is low. NHIMG reports that only 5.7% of organisations have full visibility into their service accounts, and that 97% of NHIs carry excessive privileges, which means a single malformed approval path can have outsized impact. Elicitation should therefore be paired with authentication, binding of the response to the original requester, and durable logging that can survive incident review. The same governance concern applies to approval steps that cross teams, tenants, or external systems, especially when secrets and tokens are involved. For broader identity and access governance context, see Ultimate Guide to NHIs and the controls reflected in NIST Cybersecurity Framework 2.0.
Organisations typically encounter the operational risk of elicitation only after a disputed approval, replayed response, or unauthorized action forces them to reconstruct who answered and what the agent did next, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A02 | Agentic workflows require trusted human checkpoints and safe tool-use approvals. |
| OWASP Non-Human Identity Top 10 | NHI-04 | Human approval around NHI actions depends on auditable authorization and session integrity. |
| NIST CSF 2.0 | PR.AC | Elicitation depends on access control and identity assurance around approvals. |
| NIST Zero Trust (SP 800-207) | SC-4 | Zero Trust requires continuous verification, even at human checkpoints. |
| NIST AI RMF | GOVERN | AI governance must define accountable human oversight for agent decisions. |
Treat elicitation as an untrusted interaction unless identity and context are revalidated.
