Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
2026-08-27 • Software Engineering
Software EngineeringArtificial Intelligence
AI summaryⓘ
The authors propose a method called Persona-Execution Separation (PES) to manage large language model agents in organizations. PES keeps the agent's personality (like instructions and tone) separate from its actual work execution, which needs careful tracking and auditing. This separation happens through different trusted areas connected by controlled rules, allowing the persona to change freely without losing execution traceability. The authors tested this approach in a digital employee system and confirmed that their design properly isolates persona from execution, preventing accidental mixing. PES is useful when multiple users, audit needs, and evolving personas all happen together.
Large Language ModelPersonaExecution TraceabilityTrust DomainAuditData Loss PreventionGoverned Contract BridgeTyped Change ObjectsDigital Employee PlatformModel Configuration
Authors
Yisen Xi
Abstract
Large language model (LLM) agents in governed organizations must let the persona (instructions, tone, self-presentation) evolve freely, while keeping execution (stateful, audited work) traceable. A single trust domain does not satisfy both cheaply. We present Persona-Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a graded data-loss-prevention (DLP) exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. PES follows from three goals---free drift, execution traceability, and decoupling. Under LLM representational indistinguishability, any single-domain mechanism that meets all three must re-introduce typed change objects, an external gate, and a stable audit anchor: PES rebuilt at higher coupling cost. A development/pilot case in a regulated digital-employee platform records five decisions over one month, each with a rejected alternative. A mechanism check on the shipped implementation found no execution-side re-validation under persona perturbation (five model configurations) and no persona fingerprint on hard-asserted fields. A probe of a recovered pre-separation build found the governed execution path decoupled from the persona by omission, not by construction; a later wiring change could reverse that isolation, which PES makes an audited architectural rule. The pattern applies when multi-user deployment, execution audit, and expected persona churn hold jointly.