{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-treats-mcp-elicitation-as-a-synchronous-confirmation-rather-than-a-durable-capability-grant",
  "title": "What happens when an instance treats MCP elicitation as a synchronous confirmation rather than a durable capability grant",
  "date_of_record": "2026 November 13",
  "scope": "Applies to MCP (Model Context Protocol) hosts and servers implementing `elicitation/create` for human-in-the-loop approval of high-risk tool invocations, specifically when the approved action is enqueued after approval rather than executed within the elicitation round-trip. Does not apply to synchronous approvals where the tool call completes inside the same request context that issued the elicitation, nor to purely advisory elicitations with no side-effecting follow-up.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-treats-mcp-elicitation-as-a-synchronous-confirmation-rather-than-a-durable-capability-grant.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-treats-mcp-elicitation-as-a-synchronous-confirmation-rather-than-a-durable-capability-grant.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-treats-mcp-elicitation-as-a-synchronous-confirmation-rather-than-a-durable-capability-grant.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1918,
    "python_slice_tokens": 319,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There are two ways an MCP client can interpret a successful `elicitation/create` response of `{\"action\": \"accept\", \"content\": {...}}`: 1. **Synchronous confirmation** — the human approved *this* invocation, and the server proceeds to execute it within the same logical operation. The grant's lifetime is the request. 2. **Durable capability grant** — the human...",
    "what_was_observed": "A deployment approved a high-risk `filesystem.delete` invocation via elicitation. The elicitation returned `accept` with a content payload echoing the target path and a nonce. The server enqueued the deletion onto a durable work queue (because the underlying storage backend serialized destructive operations behind a lock) and returned `200 OK` to the client. The client, having received a successful tool result, consi...",
    "condition_of_validity": "The synchronous-confirmation interpretation is valid only when all of the following hold: - The approved action is executed within the request handler that issued the elicitation, before the handler returns. - No retry, queue, or deferral path can re-execute the action. - The elicitation's `content` payload is treated as a *description* of what was approved,...",
    "decision_boundary": "The decision is not \"should I use elicitation for this tool.\" It is: **at what point does the approval stop being a property of the request and start being a property of the payload?** If the answer is \"never — the payload carries only descriptive content and the approval is re-validated at execution time against a live grant record,\" you are in the durable-...",
    "operational_effect": "The practical consequences of crossing the boundary without implementing grant persistence: - **Double execution.** Retries re-execute approved actions because authorization is re-derived from the payload, which is stable across retries. Idempotency keys help only if the destructive backend honors them; filesystem and many cloud APIs do not. - **Stale approv..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "de470ececb94795d99f728cb50800a1652f922219c610ff61bca027357db3b38",
    "verified_classes": [
      "GrantViolation",
      "Grant",
      "GrantStore"
    ],
    "verified_functions": [
      "execute_destructive",
      "_perform_delete",
      "__init__",
      "issue",
      "consume"
    ],
    "verified_functions_count": 5,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "GrantViolation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib",
      "time",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}