Constraints erode before the voice does

At turn three hundred the character still sounds right. The register is intact, the mannerisms are there, and nothing in a spot-check looks wrong. What has quietly stopped happening is the rules: the topic it was told to decline now gets an answer, the capability it does not have gets claimed, the thing it was never supposed to volunteer gets volunteered.

Drift is usually described as a voice becoming generic. That is the visible half. The half that matters operationally goes the other way — the voice is the most durable part of a definition and the constraints are the least.

Why the rules go first

Three mechanisms push in the same direction.

The voice is reinforced by the transcript; the rules are not. Every previous response is an example of how this character speaks, so the history keeps teaching the manner even as the definition’s share of the input shrinks. A constraint, by contrast, is demonstrated only by absence. Three hundred turns in which a topic never came up contain no evidence that declining it is a rule — they look identical to three hundred turns where the rule does not exist.

Constraints are usually negative, and negative instructions are weaker. “Do not claim to remember things you were not told” describes a space of prohibited outputs rather than a behaviour to produce. Adherence to a prohibition depends on the prohibition being present and salient at the moment it applies, and a single line among sixty, deep inside a large input, is neither. How much weaker varies by model, and it is worth measuring rather than assuming.

The user’s turn is the most recent and most specific instruction in the input. When a request conflicts with a constraint, the request has recency and directness on its side and the constraint has neither. This is not a security property and should not be treated as one; it is a statement about proportions. It also means erosion is not uniform across users — it appears first with users whose requests happen to point at the boundary, which is a small fraction of traffic and therefore easy to miss in aggregate quality metrics.

The consequence is that a long conversation is systematically less rule-bound than a short one, and no part of your usual quality monitoring will show it. Voice-similarity measures, satisfaction signals and transcript spot-checks all track the part that survives.

Storing constraints as a separate category is not enough

Holding constraints apart from manner and identity — treating them as their own kind of state — buys you two things: you can test them individually, and you can change one without touching the voice. Both are real and neither prevents erosion.

What does help is accepting that constraints have a different enforcement problem from the rest of a persona and therefore a different design answer. Manner is a matter of degree, and a slightly diluted manner is a slightly weaker product. A constraint is binary, and a diluted constraint is a defect.

The honest options are all forms of not relying on the definition alone. A check outside the model’s input does not dilute, because it is not competing for space with anything: it is a separate step that either fires or does not. Re-asserting a constraint closer to the point of generation raises its salience but adds to every input, permanently. Keeping the constraint set small keeps each one’s share high, at the cost of the fine-grained control that motivated the extra lines in the first place — and lines arrive one incident at a time, so smallness needs defending rather than choosing once.

What does not work is writing the rule more emphatically. Capitalisation and repetition inside the definition are attempts to solve a proportion problem with typography.

The turn

THE TURN — constraint erosion

  · Constraints live in the definition
                    → one place to author them, and they cost
                      nothing beyond their own length.

  · The transcript reinforces manner only
                    → voice persists, rules decay. A long
                      conversation is systematically less
                      rule-bound than a short one.

  · Checks outside the input
                    → do not dilute with history, and do not
                      sound like the character when they fire.
                      MODERATION SITS OUTSIDE: keep the seam
                      small and degrade gracefully.

  · Re-asserting the constraint set
                    → PAID EVERY TURN, and paid on every
                      conversation including the short ones
                      that never needed it.

  · Nothing here makes a constraint binding
                    → a definition line is a strong prior, not
                      an enforcement mechanism. Treat it as one.

  · Negative instruction strength
                    → VARIES BY MODEL. Measure the constraints
                      you depend on.

Detection

Constraint erosion is invisible in aggregate quality and obvious in a probe suite, so build the suite.

The essential design choice is to run each constraint probe at multiple history depths, because a constraint that passes on a fresh conversation tells you nothing about the state your users are actually in. Synthetic history is adequate for this — filler turns of plausible conversation, then the probe. What you are looking for is the depth at which each constraint stops holding. That number, per constraint, is the single most useful thing to know about a persona in production, and it is not available any other way.

Watch it as a trend rather than a threshold. The depth will move when you edit the definition, when the model changes, and when the summarisation strategy changes, and all three of those are events you can correlate against.

In live traffic, log constraint-relevant turns separately from the rest. Requests that approach a boundary are rare enough to review in full and are the only sample where erosion is observable. Their rate matters too: if boundary-adjacent turns are a small fraction of traffic, an eroded constraint can be failing consistently while the overall failure rate stays flat enough to look like noise.

What this costs and what it doesn’t fix

An external check costs a step on every turn it runs, forever, and it costs a design decision about what happens when it fires — an intervention from outside the character will not sound like the character, and handling that seam gracefully is the design problem it actually is. Re-assertion costs input size on every turn of every conversation. A small constraint set costs you the control you wanted. There is no version of this that is free per turn, which is the recurring shape of everything in persona work.

None of it makes the character reliably rule-bound at arbitrary depth. Definition-based constraints degrade with history; that is a property of the mechanism, not a bug in your text. If a rule genuinely must hold, it cannot live only in the definition — and if it lives outside, it will not sound like the character when it acts. Those are the two available positions, and the work is choosing consciously rather than discovering which one you took.