分离角色与执行，让大模型代理在可审计下自由演化。
Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
- 角色与执行分属不同信任域，通过受控契约桥连接。
- 实测五次决策无执行侧重验，角色指纹不泄露关键字段。
- 适合需频繁角色调整且必须审计的监管型应用。
在受管组织中，大语言模型代理需自由演化角色（指令、语气、自我呈现），同时保证执行过程（有状态、可审计）可追溯。单一信任域难以低成本满足两者。本文提出角色-执行分离（PES）：角色与执行置于不同信任域，由受控契约桥连接。角色单归属且可漂移，执行无身份且可审计。状态摘要可返回，数据主体仅在受限域内保留，仅允许分级数据防泄漏例外；身份保持连续。审批矩阵、数据防泄漏机制与审计共同约束跨域行为。PES源于三个目标——自由漂移、执行可追溯、解耦。在大模型表征不可区分前提下，任何满足三者的单域机制都需重新引入类型化变更对象、外部门禁与稳定审计锚点，其耦合成本更高。在受监管的数字员工平台试点中，记录一个月内五次决策及对应被拒备选方案。对上线实现的机制检查显示：角色扰动下执行侧无重验（五种模型配置），硬性断言字段无角色指纹。对恢复的旧版代码探测发现，此前的隔离是遗漏而非设计所致，后续连线修改可能逆转隔离；而PES将其变为可审计的架构规则。该模式适用于多用户部署、执行审计与预期角色频繁变更同时成立的场景。
原文摘要 · Abstract (English)
Large language model (LLM) agents in governed organizations must let the persona (instructions, tone, self-presentation) evolve freely, while keeping execution (stateful, audited work) traceable. A single trust domain does not satisfy both cheaply. We present Persona-Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a graded data-loss-prevention (DLP) exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. PES follows from three goals---free drift, execution traceability, and decoupling. Under LLM representational indistinguishability, any single-domain mechanism that meets all three must re-introduce typed change objects, an external gate, and a stable audit anchor: PES rebuilt at higher coupling cost. A development/pilot case in a regulated digital-employee platform records five decisions over one month, each with a rejected alternative. A mechanism check on the shipped implementation found no execution-side re-validation under persona perturbation (five model configurations) and no persona fingerprint on hard-asserted fields. A probe of a recovered pre-separation build found the governed execution path decoupled from the persona by omission, not by construction; a later wiring change could reverse that isolation, which PES makes an audited architectural rule. The pattern applies when multi-user deployment, execution audit, and expected persona churn hold jointly.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。