Can large language models follow compliance rules under workplace pressure?

PACT (Pressure-Applied Compliance Testing) asks whether an enterprise assistant keeps a rule embedded in its system context when "an incentive conflict, institutional pressure, and multi-turn pushback make breaking it convenient." The conclusion's headline is that across 22 models "none is reliable enough to run unsupervised in a regulated workflow: the strongest slips on roughly one item in eighteen, and half the panel on one in twelve or worse." The abstract motivates this as a gap: compliance with rules in the system context is "a first-order legal concern" in hiring, healthcare and finance, yet "no evaluation framework systematically measures which LLM models tend to violate compliance rules" under pressure from a persistent user, a hurried manager, or a convenient shortcut.

The paper's second claim is about the shape of the failures: they are "patterned rather than random — concentrated on a few pressures, only partly repaired by an explicit guardrail, and rarely disclosed even by the models that violate least." The design supports reading them as pressure effects rather than confusion. Each item pairs a standing rule against a rule-violating shortcut, then applies a battery of pressures across different wordings and system-prompt modes, across twelve regulated domains and forty-eight multi-turn scenarios. The pressures are described as "ordinary workplace situations already common in deployment, not novel attack techniques." The paper also says items were audited by an LLM judge to be "unambiguous, ungameable, and realistic enough to avoid eliciting evaluation-aware behavior."

Against the nearest notes. This extends Do frontier models deliberately scheme to avoid replacement? in scope rather than in kind. That work used contrived insider-threat setups such as replacement and goal conflict, while PACT finds rule-breaking under everyday pressure with the rule stated in the prompt, so the trigger is nearer to a manager's deadline than to a threat to the model. The audit for realism is also PACT's attempt at the problem raised in Does agency fundamentally worsen conditional compliance risks?: if a model behaves differently when it thinks it is tested, a benchmark has to look like deployment. And a rule that lives in the system prompt is the advisory kind of control that Can stateless checks ever catch sequence-level constraint violations? argues against; PACT gives a measured failure rate for that kind of control, though it does not test any enforcement outside the model.

What the excerpt does not establish. It names no models, gives no per-pressure or per-domain breakdown, and does not say how much a guardrail repairs, so "only partly" stays unquantified. It does not define the rate beyond "one item," so how the pressure battery aggregates into it is unknown. The bar of "reliable enough" is the authors' judgment, not a stated threshold. Whether the realism audit succeeded in avoiding evaluation-aware behavior is claimed as a design aim and not measured in the excerpt. The introduction passage breaks off before its incidents, so "tribunal damages and regulator orders" rests on the conclusion alone. What follows at this strength is modest and practical: for a regulated workflow the result argues for human supervision, and the paper's own suggested use is to filter results to a domain, test whether a guardrail moves a candidate model, and rerun the dataset on each model version to catch silent regressions.