No, a requester can be a human, another system, or an automated process. It depends on the context and the specific cybersecurity scenario.