这篇论文提出PES架构，解决LLM智能体在监管环境下的核心矛盾，人格可自由演变而执行可追溯。
研究人员提出人格-执行分离(PES)架构，解决受监管组织中LLM智能体的核心矛盾。该架构将人格(指令、语调、自我呈现)与执行(有状态、可审计工作)置于不同信任域，通过受监管的合同桥连接。在受监管数字员工平台试点中，该模式记录了5个决策，每个决策都有被拒绝的替代方案。实施机制检查发现，在人格扰动下(5种模型配置)，执行侧未重新验证，且人格未对硬断言字段留下指纹。
Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
Large language model (LLM) agents in governed organizations must let the persona (instructions, tone, self-presentation) evolve freely, while keeping execution (stateful, audited work) traceable. A single trust domain does not satisfy both cheaply. We present Persona-Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a graded data-loss-prevention (DLP) exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. PES follows from three goals---free drift, execution traceability, and decoupling. Under LLM representational indistinguishability, any single-domain mechanism that meets all three must re-introduce typed change objects, an external gate, and a stable audit anchor: PES rebuilt at higher coupling cost. A development/pilot case in a regulated digital-employee platform records five decisions over one month, each with a rejected alternative. A mechanism check on the shipped implementation found no execution-side re-validation under persona perturbation (five model configurations) and no persona fingerprint on hard-asserted fields. A probe of a recovered pre-separation build found the governed execution path decoupled from the persona by omission, not by construction; a later wiring change could reverse that isolation, which PES makes an audited architectural rule. The pattern applies when multi-user deployment, execution audit, and expected persona churn hold jointly.