Overview
- Field: Machine Learning
- Author: Yisen Xi
- Published: 2026-08-28
- arXiv: 2508.11364
- A five-month development/pilot case on a regulated digital-employee platform documents each decision alongside rejected alternatives.
- Mechanism inspection of a released implementation found no execution-side re-verification under persona perturbation (five model configurations) and no persona fingerprinting on hard-asserted fields.
- Probing a recovered pre-separation build showed the governed execution path was decoupled from the persona by omission rather than by construction; later wiring changes could silently reverse this isolation, whereas PES enforces it as an audited architectural rule.
- The pattern applies when multi-user deployment, execution auditing, and expected persona changes hold simultaneously.
Abstract (translated)
Large language model (LLM) agents in governed organizations must let the persona (instructions, tone, self-presentation) evolve freely, while keeping execution (stateful, audited work) traceable. A single trust domain does not satisfy both cheaply. We present Persona-Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a graded data-loss-prevention (DLP) exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. PES follows from three goals—free drift, execution traceability, and decoupling. Under LLM representational indistinguishability, any single-domain mechanism satisfying all three must reintroduce typed change objects, an outboard plane, and stable audit anchors—reconstructing PES at higher coupling cost.
Key Findings
*Auto-collected on 2026-08-29.*