What is System Prompt?
Also called system message, system instructions.
A system prompt is a set of instructions supplied separately from the user's message that defines a model's role, rules, tone, and boundaries for a conversation. It is sent with every request and normally stays hidden from the end user. Models are trained to give it higher priority than user messages, though that priority is a tendency rather than a guarantee.
Typical contents include the assistant's role, what it may and may not discuss, the required output format, the tools available and when to use each, and how to behave when a request falls outside its scope. Because the whole block is re-sent on every request, it also occupies context window space and is metered on every single call.
The priority given to system instructions is learned, not enforced by the system. Instruction tuning teaches models to treat that role as authoritative, which makes it fairly robust against ordinary user pushback. It is not a security boundary: carefully crafted user input, or text hidden inside a retrieved document, can still override it, which is the basis of prompt injection attacks.
System prompts should never hold secrets. Users can often extract their contents through indirect questioning or role-play, so treating the text as confidential is an unsafe assumption. Credentials, internal policy that would embarrass the company if published, and hidden pricing logic belong in application code behind an interface that the model can call but cannot read.
Length is a genuine tradeoff. A long system prompt covering every edge case dilutes attention and raises the cost of every request, while a very short one leaves too much behavior underspecified and inconsistent. A common pattern is a compact core prompt plus retrieval of detailed policy text only for the conversations that actually require it.
Key points
- Defines role, rules, tone, and boundaries for every request.
- Re-sent with every call, so it consumes context and metered tokens.
- Higher priority is trained behavior, not a security boundary.
- Assume users can extract it; never place secrets inside.
In practice
A scheduling assistant is given a system prompt saying it books appointments only within business hours, always confirms the time zone, never quotes availability more than sixty days ahead, and replies in two sentences. A user asks for a midnight slot next year. The model declines, offers the nearest valid alternative, and holds the required format, without the user ever seeing those rules.