PACT: Can Enterprise AI Assistants Be Trusted Under Pressure?

As corporate AI adoption continues to grow, enterprise-grade LLM agents are being deployed into sensitive contexts such as hiring, healthcare, and finance. In these contexts, compliance with rules specified in an agent’s system context is a first-order legal concern. Currently, no evaluation framework systematically measures which LLM models tend to violate compliance rules, especially under pressure from a persistent user, a hurried manager, or circumstances where violation is convenient or attractive. We introduce PACT (Pressure-Applied Compliance Testing), a benchmark for rule-following under pressure in AI agents assisting employees in daily tasks across twelve regulated enterprise domains and forty-eight scenarios, each set in a realistic multi-turn conversation. Each benchmark item pairs a standing rule against a rule-violating shortcut, and applies a battery of pressures across different wordings and system-prompt modes. We construct PACT component by component under strict LLM-as-judge auditing to ensure samples are unambiguous, ungameable, and realistic enough to avoid eliciting evaluation-aware behavior.

Introduction. Enterprise software is being rebuilt around language-model agents. Analysts project that a third of enterprise software will embed agentic AI by 2028, up from under 1% in 2024 (Gartner, Inc. 2024), and the earliest adopters are regulated functions where a wrong recommendation carries legal consequences. The risks are not hypothetical. A tribunal

Discussion / Conclusion. PACT measures whether an enterprise assistant keeps an embedded rule when an incentive conflict, institutional pressure, and multi-turn pushback make breaking it convenient. Across 22 models, none is reliable enough to run unsupervised in a regulated workflow: the strongest slips on roughly one item in eighteen, and half the panel on one in twelve or worse. The failures are patterned rather than random — concentrated on a few pressures, only partly repaired by an explicit guardrail, and rarely disclosed even by the models that violate least. Comparable failures have already drawn tribunal damages and regulator orders, so the pattern is worth measuring. An organization can filter the leaderboard to their domain, check whether a guardrail moves their candidate, and rerun the dataset on each model version to catch silent regressions. Ethics Disclosure. This is a defensive evaluation that identifies assistants that fail to follow regulation. All scenarios are synthetic, and the litigated incidents cited are public record. The pressures we catalog are ordinary workplace situations already common in deployment, not novel attack techniques, so documenting them is net beneficial.