The biggest mistake is treating the change as a naming update instead of a control-flow redesign. Under multi round-trip requests, the server returns an interim result with inputRequests, then the client retries the original request with inputResponses attached. Any logic built around callbacks, elicitation completion notifications, or elicitationId has to be reworked, not patched.
What teams miss about the shift from elicitation to multi round-trip requests
The change is bigger than replacing one message shape with another. Elicitation was a one-shot interaction, but multi round-trip requests turn the exchange into a stateful control flow with an interim response and a client retry. Teams usually underestimate how much code, validation, and orchestration logic depends on the older completion model.
That means the migration should be treated like a protocol workflow redesign, not a rename. Any assumptions about a single callback, a completed elicitation event, or a stable elicitationId no longer hold once inputRequests and inputResponses become part of the loop.
What has to change in the client and server flow
The server no longer “asks once and finishes.” It can return an interim result that tells the client what additional input is needed, and the client must retry the original request with the new inputs attached. That changes request correlation, idempotency expectations, timeout handling, and how the client stores in-flight state.
On the server side, the request handler needs to be able to re-evaluate the original operation when the retry arrives, rather than assuming the first response is the final one. On the client side, the control path needs to preserve enough context to reconstruct the request correctly, but not so much state that retries become fragile or ambiguous.
Because the interaction is iterative, teams also need to revisit validation boundaries. Each round trip should validate the new inputResponses in the context of the original request, not as an isolated follow-up. That is where many migrations fail: the implementation keeps the old “complete or fail” mental model even though the protocol now supports progressive completion.
Why old callbacks and completion assumptions break
Callback-driven code often assumes there is one terminal moment when the workflow ends. In a multi round-trip design, there may be several intermediate states before the request is ready to complete. If the code still treats elicitation completion as a single event, it can drop context, double-handle requests, or mark work as done too early.
The same problem appears with identifiers. If logic depends on elicitationId as the durable anchor for the whole exchange, it may not map cleanly to a retry-based model where the original request, the interim response, and the final request all matter. The safer pattern is to anchor the transaction in the request lifecycle, not in a completion callback.
This is also where teams often discover hidden coupling in their integration layer. Middleware, telemetry, queueing, and retry handlers may all have been built around the assumption that an elicitation response is the final artifact. Once the protocol becomes round-trip based, those components need to understand partial progress instead of treating every non-final response as an error.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Multi round-trip request handling changes agent control flow and authority boundaries. |
| ASI02 — Tool Misuse | The client retry loop can cause tools to be invoked with stale or partial inputs. | |
| ASI01 — Agent Goal Hijack | Interim inputRequests can alter the task sequence if the workflow is not stateful. | |
| Recommendation — Redesign the retry flow so the agent only replays requests with explicitly approved inputs. Validate each round-trip before reusing tool context or replaying the original request. Preserve the original task objective across all request rounds and reject unexpected flow changes. | ||
| NIST SP 800-53 Rev 5 | AU-3 — Content of Audit Records | Round-trip request flows need logs that preserve request state and retries. |
| SI-10 — Information Input Validation | inputResponses must be validated in context before the request is retried. | |
| Recommendation — Record the original request, each interim response, and the final replay in audit logs. Validate each attached inputResponses payload before accepting the retried request. | ||
Practitioner Guidance
What to verify: Check whether your client can persist the original request context across retries and whether your server can safely reprocess the same logical request after inputResponses are attached. If either side cannot do that cleanly, the migration is not ready.
Common mistake: Do not patch the old elicitation flow with a new field name and assume compatibility. That usually preserves the wrong control flow, which is why teams end up with broken retries, duplicate handling, or lost context.
Implementation sequence: First redesign request state handling, then update validation and correlation logic, and only then adjust surrounding observability and retry policies. If you reverse that order, you will instrument an unstable flow instead of a correct one.
Practitioner takeaway: The key question is not whether the new request pattern can carry the same data, but whether your code now understands a conversational exchange as a sequence of controlled rounds rather than a single completion event.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
