Prompting
System Prompt
Also known as: system message
A behind-the-scenes instruction that sets an AI assistant's role, rules and tone before the user's conversation begins.
A system prompt is the hidden set of instructions that tells an AI assistant how to behave, before you even start typing. It defines its role ("you are a helpful support agent"), its rules, and its tone. You usually never see it, but it shapes every answer. When a company builds an AI tool, the system prompt is where they set the personality and the boundaries.
A system prompt is a special, high-priority instruction placed at the start of the conversation that sets the assistant's persona, task, rules and constraints. Chat models distinguish message roles: the system message (application-level setup), user messages (what you type), and assistant messages (its replies).
What it is used for
- Define the assistant's role and expertise.
- Set rules ("only answer about our products", "never give medical advice").
- Fix tone, format and language.
Why it matters
It is a core tool of prompt engineering for building reliable AI products. It is also a security-sensitive area: prompt injection attacks try to make the model ignore its system prompt.
The system prompt is the highest-priority segment of the conditioning context, conventionally the first message under a distinct system role, used to specify persona, task framing, policies, tools and output contracts. Instruction-tuned models are trained to weight it above user turns, establishing a soft instruction hierarchy, though this precedence is probabilistic, not a hard security boundary.
Practically it anchors product behaviour and consistency across a session and consumes context-window budget that persists throughout. Its security implications are significant: because system and user text share the same channel, adversarial input can attempt prompt injection to override or exfiltrate it, so system prompts should not hold secrets and should be paired with independent guardrails, input/output filtering, and least-privilege tool access. Robust instruction-hierarchy training and separation of trusted from untrusted content are active mitigations.