智能体
arxiv.org ·
人设-执行分离：执行审计下演化 LLM 智能体的架构模式
arXiv 论文提出 Persona-Execution Separation（PES）架构模式：将 LLM 智能体的人设（指令、语气、自我呈现）与执行（有状态、可审计的工作）置于不同信任域，通过受治理的契约桥连接，人设可单点托管并自由漂移，执行侧无面且受审计，仅允许状态摘要回传，数据主体保留在受限域（DLP 例外），身份保持连续，并以审批矩阵、DLP 和审计约束跨域行为。作者论证在 LLM 表示不可区分性下，任何满足自由漂移、执行可追溯与解耦三目标的单域机制都必须重新引入类型化变更对象、外部闸门和稳定审计锚点，即等价于以更高耦合成本重建 PES。文中记录了一个受监管平台的开发/试点案例（一个月内五次决策，四次含被拒备选），机制检查发现五种配置下人设扰动未触发执行侧重验证、完成运行的硬断言字段无人设指纹；在受监管编码智能体上的受控复现跨五个模型、四家提供商重现了隔离下的分离，桥接开销在两个环境中均低于端到端时间的 0.2%；对分离前构建的探针显示执行路径与人设的解耦源于遗漏而非构造。该模式适用于多用户部署、执行审计与人设频繁变更同时成立的场景。
AI推荐理由 arXiv 预印本，单一作者，摘要给出了明确的问题设定（受治理组织中 LLM 智能体需让人设自由演化、执行可审计）、架构模式 PES 的机制描述（人设与执行分属不同信任域、受治理契约桥、审批矩阵、DLP、审计），以及一个受监管平台的开发/试点案例（一个月内五次决策、四次含被拒备选）、机制检查（五种配置下人设扰动未触发执行侧重验证、完成运行硬断言字段无人设指纹）、跨五模型四提供商的受控复现（桥接开销低于端到端时间 0.2%）和分离前构建的探针结果。信息密度较高，含具体实验条件与量化开销，属可验证的研究性工作。局限：单一作者、案例规模小、未提供同行评审或独立复现，摘要中的结论仍需全文核实；对 Agent 架构与合规审计方向有实际参考价值，但非官方首发或产品落地证据。
72
正文
Computer Science > Software Engineering
arXiv:2608.27427 (cs)
[Submitted on 27 Aug 2026 (v1), last revised 14 Sep 2026 (this version, v2)]
Title:Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
Authors:Yisen Xi
View a PDF of the paper titled Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit, by Yisen Xi
View PDF
HTML (experimental)
Abstract:Large language model (LLM) agents in governed organizations must let the persona (instructions, tone, self-presentation) evolve freely, while keeping execution (stateful, audited work) traceable. A single trust domain does not satisfy both cheaply. We present Persona-Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge. The persona is singly-homed and may drift; execution is faceless and audited. Status summaries may return; data bodies remain in the restrictive domain except a data-loss-prevention (DLP) exception; identity stays continuous. An approval matrix, DLP, and audit enforce the crossing. PES follows from three goals: free drift, execution traceability, and decoupling. Under LLM representational indistinguishability, any single-domain mechanism meeting all three must re-introduce typed change objects, an external gate, and a stable audit anchor: PES rebuilt at higher coupling cost. A development/pilot case in a regulated platform records five decisions over one month, four with rejected alternatives. A mechanism check found no execution-side re-validation under persona perturbation (five configurations) and no persona fingerprint on hard-asserted fields of completed runs. A controlled replication in regulated coding agents reproduced the separation under isolation across five models and four providers; bridge overhead was under 0.2% of end-to-end time in both environments. A probe of a pre-separation build found the execution path decoupled from the persona by omission, not by construction. The pattern applies when multi-user deployment, execution audit, and persona churn hold jointly.
Comments:
Subjects:
Software Engineering (cs.SE); Artificial Intelligence (cs.AI)
Cite as:
arXiv:2608.27427 [cs.SE]
(or
arXiv:2608.27427v2 [cs.SE] for this version)
https://doi.org/10.48550/arXiv.2608.27427
Focus to learn more
arXiv-issued DOI via DataCite
Submission history
From: Yisen Xi [view email]
[v1]
Thu, 27 Aug 2026 17:50:07 UTC (192 KB)
[v2]
Mon, 14 Sep 2026 10:12:37 UTC (418 KB)
Full-text links:
Access Paper:
View a PDF of the paper titled Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit, by Yisen Xi
View PDF
HTML (experimental)
TeX Source
view license
Ancillary-file links:
Ancillary files (details):
ESM1.pdf
Current browse context:
cs.SE
new
|
recent
| 2026-08
Change to browse by:
cs
cs.AI
References & Citations
NASA ADS
Google Scholar
Semantic Scholar
export BibTeX citation
Loading...
BibTeX formatted citation
×
loading...
Data provided by:
Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
Connected Papers Toggle
Connected Papers (What is Connected Papers?)
Litmaps Toggle
Litmaps (What is Litmaps?)
scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
Code, Data, Media
Code, Data and Media Associated with this Article
alphaXiv Toggle
alphaXiv (What is alphaXiv?)
Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub Toggle
DagsHub (What is DagsHub?)
GotitPub Toggle
Gotit.pub (What is GotitPub?)
Huggingface Toggle
Hugging Face (What is Huggingface?)
ScienceCast Toggle
ScienceCast (What is ScienceCast?)
Demos
Demos
Replicate Toggle
Replicate (What is Replicate?)
Spaces Toggle
Hugging Face Spaces (What is Spaces?)
Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
Related Papers
Recommenders and Search Tools
Link to Influence Flower
Influence Flower (What are Influence Flowers?)
Core recommender toggle
CORE Recommender (What is CORE?)
Author
Venue
Institution
Topic
About arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? |
Disable MathJax (What is MathJax?)