角色与执行分离：在执行审计下演进LLM智能体的架构模式
文章背景与核心概要
在受到监管的组织中运行的大语言模型（LLM）智能体面临着一个根本性的架构矛盾：角色（指令、语气、自我呈现）需要自由演进和漂移，而执行层（有状态的、由任务驱动的工作）必须保持严格的可追溯性和可审计性。单一的信任域无法在低成本下同时满足这两方面的需求。
本文引入了角色-执行分离（Persona-Execution Separation, PES）架构模式，旨在解决这一矛盾。通过将角色和执行解耦到由受监管的契约网桥连接的独立信任域中，PES能够在不妥协执行环境的完整性、安全性和可审计性的前提下，实现角色的持续演进。该模式通过审批矩阵、数据丢失预防（DLP）机制和审计机制来强制执行域间跨越，为多用户部署、执行审计要求以及高频角色变动场景提供了稳健的解决方案。
📋 执行摘要 (Executive Summary)
Large Language Model (LLM) agents operating within governed organizations face a fundamental architectural tension: personas (instructions, tone, self-presentation) need to evolve and drift freely, while execution layers (stateful, task-driven work) must remain strictly traceable and audited.
This paper introduces Persona-Execution Separation (PES), an architecture pattern designed to resolve this tension. By decoupling the persona and execution into separate trust domains connected by a governed contract bridge, PES enables continuous persona evolution without compromising the integrity, security, or auditability of the execution environment.
在受监管组织中运行的大语言模型（LLM）智能体面临着一个根本性的架构张力：角色（指令、语气、自我呈现）需要自由演进和漂移，而执行层（有状态、由任务驱动的工作）则必须保持严格的可追溯性与可审计性。单一的信任域无法以低成本兼顾这两者。
本文推出了角色-执行分离（Persona-Execution Separation, PES）架构模式，旨在化解这一张力。通过将角色与执行解耦至通过受监管契约网桥连接的独立信任域中，PES能够在不损害执行环境的完整性、安全或可审计性的前提下，实现持续的角色演进。
🔍 摘要 (Abstract)
Large language model (LLM) agents in governed organizations must let the persona (instructions, tone, self-presentation) evolve freely, while keeping execution (stateful, audited work) traceable. A single trust domain does not satisfy both cheaply.
We present Persona-Execution Separation (PES): persona and execution reside in different trust domains, connected by a governed contract bridge. * The Persona: Singly-homed and allowed to drift. * The Execution: Faceless and audited. * Data Flow: Status summaries may return; data bodies remain in the restrictive domain except via a graded data-loss-prevention (DLP) exception. * Identity: Stays continuous.
An approval matrix, DLP, and audit mechanisms enforce the domain crossing. PES naturally follows from three core goals: free drift, execution traceability, and strict decoupling.
Under LLM representational indistinguishability, any single-domain mechanism meeting all three goals must re-introduce typed change objects, an external gate, and a stable audit anchor—essentially rebuilding PES at a higher coupling cost.
Key Findings & Implementation Insights
- Development/Pilot Case: A regulated digital-employee platform recorded five architectural decisions over one month, each evaluated against a rejected alternative.
- Mechanism Check: The shipped implementation showed no execution-side re-validation under persona perturbation (tested across five model configurations) and no persona fingerprint on hard-asserted fields.
- Retrospective Probe: A probe of a recovered pre-separation build revealed that the governed execution path was decoupled from the persona merely by omission rather than construction—meaning a later wiring change could have quietly reversed that isolation. PES enforces this isolation as a permanent architectural rule.
受监管组织中的大语言模型（LLM）智能体必须允许角色（指令、语气、自我呈现）自由演进，同时保持执行（有状态、经审计的工作）的可追溯性。单一信任域无法以低成本满足这两点。
我们提出了角色-执行分离（PES）：角色与执行处于不同的信任域中，并通过受监管的契约网桥进行连接。 * 角色（The Persona）： 单一归属，允许漂移。 * 执行（The Execution）： 无面且受审计。 * 数据流（Data Flow）： 允许返回状态摘要；除通过分级的数据丢失预防（DLP）例外情况外，数据主体保留在受限制的域中。 * 身份（Identity）： 保持连续。
审批矩阵、DLP和审计机制共同强制执行域间跨越。PES自然源于三个核心目标：自由漂移、执行可追溯性以及严格解耦。
在LLM表征不可区分性的情况下，任何满足上述三个核心目标的单域机制都必须重新引入类型化变更对象、外部网关和稳定的审计锚点——这本质上是以更高的耦合成本重新构建了PES。
关键发现与实现洞察
- 开发/试点案例： 一个受监管的数字员工平台在一个月内记录了五项架构决策，每项决策都与被否决的替代方案进行了评估。
- 机制检查： 发布的实现在角色扰动下（在五种模型配置下进行测试）表现出无执行侧重新验证，并且在硬断言字段上无角色指纹。
- 回顾性探测： 对恢复的分离前构建版本的探测表明，受监管的执行路径与角色解耦仅仅是通过遗漏而非构建实现的——这意味着后期的线路更改可能会悄悄地逆转这种隔离。PES将这种隔离强制定义为一项永久的架构规则。
🛠️ 适用性 (Applicability)
The PES pattern is recommended when multi-user deployment, execution audit requirements, and expected persona churn hold jointly.
当多用户部署、执行审计要求以及预期的角色频繁更迭同时存在时，推荐使用PES模式。