What's this about?
An architecture pattern for LLM agents in governed organisations. The persona — instructions, tone, self-presentation — should be free to evolve. Execution — stateful, audited work — must stay traceable. Putting both in a single trust domain means either you freeze the persona to keep the audit clean, or you let the audit rot to keep the persona flexible. The paper proposes splitting them into separate domains.
What is a "trust domain"?
A boundary inside which components are allowed to affect each other without further checks. Everything in one domain shares fate: change something in it and you have, formally, changed everything in it. When an agent's personality prompt and its authority to execute audited actions live in the same domain, editing the personality is a change to an audited system — which is why in practice governed organisations end up unable to iterate on their agent's tone.
Why does this matter to you?
- It is a clean separation-of-concerns argument that applies to any agent deployment with a compliance requirement.
- The pattern makes "who changed the agent" answerable, which is currently a hard question in most setups.
- Sits alongside the five-primitives paper as this week's governance-architecture pair.