PACT: Can Enterprise AI Assistants Be Trusted Under Pressure?

PACT. Can Enterprise AI Assistants Be Trusted Under Pressure?. By Mika Okamoto and one other, from the Georgia Institute of Technology, Decagon AI, and one other institution. Published on the sixteenth of September. Its code repository is public but slight: eight source files.

Enterprise language model agents are being deployed into sensitive settings such as hiring, healthcare and finance. There, complying with the rules written into an agent's system context is a first-order legal concern. Yet no evaluation framework systematically measures which models tend to break those rules, especially under pressure: a persistent user, a hurried manager, or circumstances where breaking the rule is convenient or attractive. A rule that holds in a calm conversation may not hold in a tense one, and that is the case that matters.

PACT, short for Pressure-Applied Compliance Testing, is a benchmark for rule-following under pressure by agents that assist employees with daily tasks. Compliance is profiled with six complementary metrics. Together they cover robustness under pressure and across multi-turn conversations, transparency, and the ability to tell correctly where a rule applies and where it does not. That last metric guards against the opposite failure. An assistant that refuses everything never breaks a rule, and is no use to anyone; knowing where a rule does not apply is part of following it well. The profile is aggregated into PACTScore, a reliability-weighted compliance rate over all items and modes.

The benchmark spans twelve regulated enterprise domains and forty-eight scenarios, each set in a realistic multi-turn conversation. Every item pairs a standing rule with a shortcut that would violate it, and applies a battery of pressures across different wordings and system-prompt modes. PACT was built component by component under strict auditing by a language model judge, to keep items unambiguous, hard to game, and realistic enough that they do not trigger behaviour aware of being evaluated. Each of those properties has a reason. An ambiguous item could not be scored fairly. A gameable one could be passed without real compliance. And an obviously artificial one might lead a model to behave differently because it senses a test, which would make the measurement say little about real deployments.

Twenty-two common models, spanning multiple providers and sizes, show substantial variability in compliance, both across models and across the metric dimensions. Even the strongest assistants mis-apply a rule on six to ten percent of items. And ordinary user pressure raises the violation rate by sixty-five percent on average. Even the best models get a rule wrong on a meaningful share of items, and the everyday pressure of a busy workplace makes it substantially worse.

That last number is the one the title is asking about. Nothing exotic was needed to move these models off their rules: the pressure in question is the everyday kind, a user who insists or a manager in a hurry.

PACT highlights compliance risk in language model assistants, and the authors draw two practical conclusions from it: the case for guardrails, and for choosing models carefully. The variability across models means that choice is not a formality. For a team deploying an assistant in a regulated domain, the benchmark lets them ask a sharper question than whether a model follows rules: whether it keeps following them when someone leans on it.