Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
Paper Guide Brief
Reading Brief
This paper introduces Persona-Execution Separation (PES), an architecture pattern for LLM agents in governed organizations that separates the persona (instructions, tone, self-presentation) from execution (stateful, audited work) into different trust domains connected by a governed contract bridge. The pattern is motivated by three goals: free persona drift, execution traceability, and decoupling. The paper presents a formal proposition, a single-case study in a regulated digital-employee platform with five architecture decisions, and validation results including mechanism checks, A/B isolation tests, and a control-arm probe. Results show zero execution-side re-validation under persona perturbation across five model configurations and no persona fingerprint on hard-asserted fields, though the control arm found the pre-separation build was decoupled by omission rather than by construction.
Central Claim
The paper proposes a novel architecture pattern (PES) for LLM agents that separates persona and execution into different trust domains, enabling both persona evolution and execution auditability.
Contribution
The paper proposes a novel architecture pattern (PES) for LLM agents that separates persona and execution into different trust domains, enabling both persona evolution and execution auditability. It provides a formal necessity argument, a detailed case study with five architecture decisions, and empirical validation on a development/pilot deployment.
Why It Matters
The novelty lies in applying the classical principle of change isolation to an LLM agent's operational identity (the persona), rather than to code modules, and formalizing the necessity of separation under LLM representational indistinguishability.
Prerequisites
architecture pattern, case study, mechanism check, A/B testing, control-arm probe
Atlas Placement
Software Engineering (subfield)
Read If
You care about architecture pattern, case study, mechanism check.
Skip If
You only care about V1 mechanism verification, V2 A/B isolation check.
Noosaga Placements
- The paper proposes an architecture pattern for software systems, specifically LLM agents, and includes a case study with architecture decision records.We present Persona–Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge.The reference case is a single-tenant development/pilot deployment.
- AI Safety and Alignmentframework60%The paper discusses AI governance and safety, referencing threat models and separation-based mitigation, which aligns with AI Safety and Alignment.PES is a governance/evolution pattern, and security-angled separation is complementary.The threat sketch (Section 4.4) answers the obvious questions but is not a threat model.
- The paper focuses on LLM agents, which are a core AI topic, and discusses AI governance and safety aspects.Large language model (LLM) agents in governed organizations must let the persona evolve freely, while keeping execution traceable.PES is a governance/evolution pattern.
- AI Governance and Sociotechnical Approachesframework50%The paper addresses governance and sociotechnical aspects of AI systems, including organizational trust domains and approval matrices.An approval matrix, DLP, and audit enforce the crossing.PES is a governance/evolution pattern.
- The paper addresses safety and governance concerns for LLM agents, including threat sketches and separation-based mitigation.The threat sketch (Section 4.4) answers the obvious questions but is not a threat model.PES is a governance/evolution pattern, and security-angled separation is complementary.
Abstract
Large language model (LLM) agents in governed organizations must let the persona (instructions, tone, self-presentation) evolve freely, while keeping execution (stateful, audited work) traceable. A single trust domain does not satisfy both cheaply. We present Persona-Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a graded data-loss-prevention (DLP) exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. PES follows from three goals---free drift, execution traceability, and decoupling. Under LLM representational indistinguishability, any single-domain mechanism that meets all three must re-introduce typed change objects, an external gate, and a stable audit anchor: PES rebuilt at higher coupling cost. A development/pilot case in a regulated digital-employee platform records five decisions over one month, each with a rejected alternative. A mechanism check on the shipped implementation found no execution-side re-validation under persona perturbation (five model configurations) and no persona fingerprint on hard-asserted fields. A probe of a recovered pre-separation build found the governed execution path decoupled from the persona by omission, not by construction; a later wiring change could reverse that isolation, which PES makes an audited architectural rule. The pattern applies when multi-user deployment, execution audit, and expected persona churn hold jointly.
Paper Context
Classified from the full extracted paper text (99,621 characters). The Paper Guide brief above is the user-facing synthesis; raw context is kept out of the page.
Full-paper context sent 99,621 of 99,621 extracted characters to classification.