The ootb solution for step-up is initiated by the authorization framework. The premise being that “step-up” is a requirement for “access”. There are many ways to identify the need for step-up. One common one being the “authentication level”, another the authentication service name.
I reiterate that many incorrectly merge the conversations and needs of authentication and authorization.
We seem to be going back and forth. For further information do see: Session upgrade :: AM 7.5.0