What Is a System Prompt? – Definition and How It Works
Learn what a system prompt is, how it differs from user messages, what belongs in it, and why it is not a security boundary.
A system prompt is the instruction block that establishes how a model should behave for a conversation: its role, its constraints, its output conventions, and what it should refuse.
1. What It Is
A message with elevated priority, placed before the conversation.
- Set once, applying to every turn.
- Higher priority than user messages in most models' training.
- Not privileged in a security sense — it is text in the same context window.
2. System Versus User Messages
| Aspect | System | User |
|---|---|---|
| Purpose | How to behave | What to do now |
| Lifetime | The whole conversation | One turn |
| Priority | Higher | Lower |
| Author | The application | The person |
Putting turn-specific instructions in the system prompt makes it grow without bound; putting behavioural rules in each user message makes them inconsistent.
3. What Belongs In It
- Role and scope — what this assistant is for, and what is out of scope.
- Output conventions — format, length, tone, and structure.
- Constraints — what to refuse, and what to do when uncertain.
- Tool guidance — when to call which tool.
- Stable context — facts true for every conversation.
4. What Does Not Belong
- Secrets. Anything in the context can surface in output.
- Large documents. They consume the window on every turn; retrieve instead.
- Per-request data. That belongs in the user message.
- Duplicated tool descriptions. Tool schemas already carry them.
5. Why It Is Not a Security Boundary
The model sees one stream of text. A system prompt has higher priority through training, not through architecture, so sufficiently persuasive content elsewhere in the context can override it.
Real controls live outside the model: authorisation in application code, restricted tool scope, output validation, and limited egress. Treat the system prompt as a strong default rather than as a guarantee.
6. Writing an Effective One
- Be specific about scope, including what to decline.
- State the output format explicitly.
- Give the refusal behaviour a concrete form.
- Keep it as short as it can be while covering those; long prompts dilute attention.
- Structure it with headings so instructions do not blur together.
- Version it and evaluate changes against a fixed set.
7. It Is Not Secret
Users can often elicit an approximation of a system prompt, so it should contain nothing whose disclosure would matter. Assume it is public, and keep confidential material out of it entirely.
8. Summary
A system prompt sets persistent behaviour — role, constraints, format, tool guidance — for a whole conversation, at higher priority than user turns.
It is a strong default, not a boundary. Keep it short and specific, keep secrets out of it, and enforce anything that matters in application code rather than in instructions.