Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit
Persona-Execution Separation isolates mutable agent behavior from audited, stateful work through a governed bridge. It is an architecture option for multi-user agents under compliance constraints.
**Persona-Execution Separation** places persona and execution in different trust domains joined by a governed contract bridge. Execution remains faceless and audited; summaries can return, while data bodies stay restricted unless a graded DLP exception applies.
For multi-user agents with frequent prompt or persona changes, keep stateful actions behind typed changes, approvals, DLP, and a stable audit anchor. Treat persona updates as untrusted presentation changes rather than execution-policy changes.
**Persona-Execution Separation** places persona and execution in different trust domains joined by a governed contract bridge. Execution remains faceless and audited; summaries can return, while data bodies stay restricted unless a graded DLP exception applies. For multi-user agents with frequent prompt or persona changes, keep stateful actions behind typed changes, approvals, DLP, and a stable audit anchor. Treat persona updates as untrusted presentation changes rather than execution-policy changes. The evidence is a **one-month pilot** recording five decisions plus checks across **five model configurations**. The pattern is scoped to systems that jointly require persona churn, multi-user deployment, and execution audit.
This narrows prior harness guidance to agents whose personas change frequently across multiple users: identity and presentation should remain replaceable without altering the trusted execution boundary. It adds a concrete data-flow rule—return summaries by default and expose bodies only through graded DLP exceptions—but its one-month, five-decision pilot across five model configurations supports a scoped architecture pattern, not broad effectiveness claims.