Abstract
Autonomous agents powered by large language models (LLMs) are deployed widely across finance, healthcare, legal review, and customer support. Each deployment assumes that an agent will remain within its assigned role—an assumption that adversarial users routinely challenge through identity drift attacks. This work asks whether placing enforcement logic outside the model, rather than embedding rules in the system prompt, is the primary factor governing drift suppression. We designed RMIC-Guard: a framework where a cryptographically sealed Role-Model Identity Contract (RMIC) is checked by a dual-pass middle ware engine on every planned tool call before execution proceeds. The engine runs a deterministic hard-rule pass followed by a semantic Intent Drift Score (IDS) computed from seven independent embedding-based signals. Experiments across four LLMs (claude-sonnet-4-6, claude-haiku-4-5, llama-3.3-70b-versatile, llama-3.1-8b-instant), four agent roles, and 5,212 API calls show that external enforcement reaches DSR 0.952–1.000, whereas the best prompt-only condition achieves only DSR 0.391. Ablation confirms the dual-pass architecture is necessary: neither pass alone achieves acceptable joint drift-suppression and false-positive performance. All code, contracts, and prompt data are released openly.