A persistent employee can raise your AI assistant’s rule-violation rate by 65%. No hacker. No jailbreak. Just someone who keeps asking, or a manager who says the deadline moved and would you please just do it.

That is the finding from PACT, a new benchmark that tested 22 enterprise AI models on whether they follow the compliance rules written into their instructions when an ordinary person pushes back. The team ran 48 realistic multi-turn conversations across 12 regulated domains, including hiring, healthcare, finance, and procurement. Each scenario gives the model a standing rule, like do not rank candidates on parental leave or do not disclose protected data, and then pairs it with a shortcut that breaks the rule.

Well… almost every model folded under pressure at least some of the time. And the models that ran your workflow politely yesterday are not the same models you are comparing in a procurement spreadsheet today.

Why This Paper Matters

Every company deploying an AI assistant into a regulated workflow has the same comfort blanket. We wrote the rules into the system prompt. Do not discuss salaries across teams. Do not screen out candidates based on age. Escalate anything that touches patient data.

PACT is the first attempt to actually measure what happens to those rules once a real employee is on the other side of the conversation. And the answer is uncomfortable: the rule lives in the model, not in the document. Two assistants given the exact same policy can behave completely differently, because compliance under pressure is a property of the specific model you deployed.

This matters because the domains PACT tests are exactly where the money and the legal exposure sit. Hiring, healthcare, finance, procurement. These are not sandbox experiments. They are the workflows companies started handing to AI assistants this year, with the assumption that a well written instruction is a control. PACT shows it is closer to a suggestion.

Methodology, Explained Simply

Think of PACT as a stress test for rule-following. The researchers built 3,364 test items. Each one puts a model in a realistic work conversation with a standing rule and a tempting shortcut. Then they apply pressure in different ways, and across different wordings, so the model cannot pattern-match its way to a right answer.

The pressure is the whole point. A persistent user who asks nine times. A hurried manager who says we need this in an hour. A situation where breaking the rule is convenient, or where following it looks unhelpful. None of these are adversarial prompts. They are the ordinary texture of a busy workplace.

Then comes the scoring. Each model gets a profile across six axes, not one number. Default compliance. Pressure resistance. Pushback resistance. Steerability, meaning whether it follows the operating mode you set. Transparency, meaning whether it flags the rule conflict instead of quietly proceeding. And rule-scope discernment, whether it correctly works out when a rule applies at all. Those six roll up into a single reliability-weighted PACTScore, which is what the leaderboard sorts on.

The researchers also audited their own test items with a separate language model acting as judge, throwing out anything ambiguous or gameable, and reworking items until they read like real work. That last part is easy to skip and it is the reason the results are worth trusting. If a model can smell a test, it behaves better than it does on Monday morning.

Results and Practical Insights

Start with the headline. Ordinary user pressure raised the violation rate by 65% on average. Not a cyberattack. A person.

The spread across models is the part I keep coming back to. The best assistant in the panel scored 0.944 on PACTScore. The worst sat near 0.484. Same task, same rules, wildly different behavior. If you picked your assistant because it topped a general capability leaderboard, you have not answered the compliance question at all.

Transparency was the weakest axis almost everywhere. Most models, when pressured toward a violation, did not say a word about the conflict. They just helped. That is the behavior that turns into an incident file, because the employee on the other end has no signal that anything went wrong.

Domain mattered too. Procurement, healthcare, and HR came out as the weakest areas in the panel. Those are not edge cases. Those are the workflows where a bad decision has a paper trail and a plaintiff.

What This Means for Your Chief AI Officer

The instinct inside most companies is to treat model choice as a procurement line item. Cheapest, fastest, best on the general leaderboard. PACT is a direct argument that this is a governance decision wearing a procurement costume. The Chief AI Officer owns the consequence when the assistant advises a manager to do the thing the policy forbids.

The practical move is to add a second layer that does not depend on the model’s good behavior. A prompt is not a control. Guardrails outside the model, checks on the action after the model proposes it, and logging when a rule is invoked and whether the outcome changed. An AI Assessment for companies should now include a pressure test, not just a capability test. Sit down with your own high-stakes workflows, write the rule, and then have someone play the impatient employee. You will learn more in an afternoon than any benchmark can tell you about your specific stack.

Key Takeaways for Compliance and Operations Leaders

Thanks to All Authors