What is System Prompt?
System Prompt is the high-priority instruction layer that defines an LLM application's persistent role, behavior, constraints, and response policy.
How It Works
A system prompt is not just a hidden preface to a chat. It is part of the application contract between product behavior, safety policy, tool access, and the model's runtime context. Good system prompts are explicit about role, scope, refusal rules, source use, tool boundaries, formatting expectations, and what to do when information is missing. They should be versioned, tested, and kept short enough to preserve context budget, because vague or bloated system prompts can create inconsistent behavior and higher latency.
Key Characteristics
- Has higher priority than normal user instructions in most chat frameworks
- Defines persistent role, style, boundaries, and output expectations
- Often encodes safety, tool-use, source-grounding, and escalation policy
- Consumes context-window budget on every request unless cached
- Should be versioned and regression-tested like application logic
Common Use Cases
- Defining a customer-support assistant's tone and escalation rules
- Restricting an agent to approved tools and data sources
- Specifying citation and grounding requirements for RAG answers
- Setting refusal behavior for unsafe or out-of-scope requests
- Keeping response format consistent across a product surface
Example
Loading code...Frequently Asked Questions
Is a system prompt secure by itself?
No. It helps guide behavior, but security also needs tool permissions, input validation, retrieval controls, monitoring, and prompt-injection defenses.
Should system prompts be long?
Only as long as needed. Long prompts consume context budget, increase prefill cost, and can contain conflicting instructions.
Why version system prompts?
Prompt changes can alter product behavior. Versioning enables rollback, review, evaluation, and incident analysis.
How should system prompts be tested?
Use regression cases that cover allowed tasks, refusals, tool boundaries, missing context, formatting, and adversarial inputs.