The system prompt is a special message (in most chat-style APIs) that sets persistent behavior, persona, and constraints for the entire conversation — separate from the user's actual messages, and generally treated with more authority by the model.
Structure of a Typical Chat Request
# Conceptual — see LLM API for real provider-specific syntax
messages = [
{"role": "system", "content": "You are a support assistant for
Acme Corp. Only answer questions
about Acme products. Be concise."},
{"role": "user", "content": "What's your return policy?"}
]The system message is sent once (often re-sent with every request in the conversation, since the model has no memory between calls — see How LLMs Work), establishing ground rules the user's messages then operate within.
What Belongs in a System Prompt
| Good Fit | Example |
|---|---|
| Persona / role | "You are a senior tax advisor..." |
| Persistent constraints | "Never provide medical diagnoses; recommend consulting a doctor instead." |
| Output format rules | "Always respond in valid JSON matching this schema: ..." |
| Scope boundaries | "Only answer questions related to our product documentation." |
System Prompts Are Not an Absolute Security Boundary
System prompts get more weight from the model than a typical user message, but they are not a hard, unbreakable barrier — a sufficiently crafted user input can sometimes cause a model to deviate from system instructions (see Prompt Injection). Treat the system prompt as a strong steering mechanism, not a guaranteed security control on its own — genuine safety-critical constraints need enforcement outside the model too (validation, guardrails).
Practical Use Case
A single application often reuses one carefully tuned system prompt across every user conversation — it's effectively the application's core behavior specification, worth version-controlling and testing like any other piece of application logic.
Common Mistakes
- Assuming the system prompt makes a behavior unconditionally guaranteed, with no other safeguards — treat critical constraints as needing enforcement beyond just prompting
- Cramming task-specific, one-off instructions into the system prompt instead of the user message, making the system prompt bloated and harder to maintain across different use cases
Interview Relevance
"Is a system prompt a reliable security boundary?" — no, not on its own; a good answer explains why (susceptibility to injection) and what should back it up (validation, guardrails, least-privilege tool access).
Practice Question
Write a system prompt for an internal HR assistant that should only answer policy questions and must never disclose specific employee salary information.
