Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
A paper on arXiv proposes Persona-Execution Separation (PES), an architecture pattern for LLM agents in governed organizations. PES places persona and execution in different trust domains connected by a governed contract bridge. The persona may drift freely; execution is faceted and audited. Status summaries may return, but data bodies remain in the restrictive domain except for graded DLP exceptions. An approval matrix, DLP, and audit enforce the crossing. The paper reports a development/pilot case in a regulated digital-employee platform with five decisions over one month, each with a rejected alternative.
The paper introduces Persona-Execution Separation (PES) as an architecture pattern for evolving LLM agents under execution audit. It separates the persona (instructions, tone, self-presentation) from execution (stateful, audited work) into different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a graded data-loss-prevention (DLP) exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. PES follows from three goals: free drift, execution traceability, and decoupling. Under LLM representational indistinguishability, any single-domain mechanism that meets all three must re-introduce typed change objects, an external gate, and a stable audit anchor: PES rebuilt at higher coupling cost. A development/pilot case in a regulated digital-employee platform records five decisions over one month, each with a rejected alternative. A mechanism check on the shipped implementation found no execution-side r…
PES separates persona and execution into different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a graded DLP exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. The paper argues that under LLM representational indistinguishability, any single-domain mechanism meeting all three goals must re-introduce typed change objects, an external gate, and a stable audit anchor, effectively rebuilding PES at higher coupling cost.
The pattern addresses governance needs in regulated organizations deploying LLM agents, where persona evolution must be decoupled from audited execution. The pilot case in a regulated digital-employee platform suggests early adoption in enterprise settings requiring compliance and traceability.
PES enables organizations to evolve LLM agent personas without compromising execution auditability, reducing compliance risk and enabling faster iteration in governed environments. It may lower the cost of maintaining auditable agent systems by avoiding single-domain coupling.
Observable next signals include further case studies in regulated industries, tooling support for PES contract bridges, and standardization of audit mechanisms for LLM agent execution. The paper's mechanism check may lead to formal verification of PES implementations.