System Prompt: The Standing Instructions of Your AI Product

The system prompt is the set of instructions a developer sends the model with every request. What it holds, what it doesn't, and why it isn't safe for secrets.

info Quick Definition

The system prompt is the set of standing instructions a developer sends to the model along with the conversation to define its role, tone, limits and format. The user usually does not see it, but feels its effect in every answer.

What is it and how is it used in the APIs?

A model remembers nothing between requests: every API call carries everything the model needs. The system prompt is the part of that call that sets the overall frame and that the user does not write. It is the natural place to say what the product is, who it works for, what tone it uses and what format it must deliver.

Each provider names it differently:

Anthropic (Claude): a top-level system parameter in the Messages API. The reference describes it as a way of giving Claude context and instructions, such as a goal or a role. Its prompting guide says that setting a role in the system prompt focuses Claude’s behavior and tone, and that even a single sentence makes a difference.
OpenAI: the developer role (messages from the application developer, prioritized ahead of user messages) and the instructions parameter of the Responses API, which takes priority over input. According to the documentation, instructions only applies to the current request: if you chain responses with previous_response_id, earlier instructions do not carry into the new context.
Google (Gemini): a system_instruction parameter sent alongside the rest of the request.

The concept is the same and the name changes: check the documentation of the provider you use.

Like any text in the context window, the system prompt takes tokens in every request. A 3,000-token one is paid on every turn, unless the provider offers caching for that part; see prompt caching.

Do not confuse it with two related concepts. The user prompt is what the person types each turn. The system prompt is what the team writes once for all conversations. Context engineering is the broader discipline of deciding everything that goes into the context window: system prompt, history, retrieved documents and tool results. The system prompt is one piece of that set, not the whole set.

It also exists in well-known products. Anthropic publishes the system prompts of claude.ai and its mobile apps, which provide information such as the current date and encourage behaviors such as showing code in Markdown. Anthropic states that those updates do not apply to the API: anyone using the API starts without that prompt and writes their own.

What should it contain?

A good system prompt answers five questions:

Who the assistant is: its role and its relation to the brand.
Who it works for: the audience and its level of knowledge.
What it does and does not do: permitted tasks and explicit limits.
How it speaks: tone, length and language.
How it delivers the answer: format, with an example if needed.

Write it in clear prose and short sections. Avoid endless lists of exceptions: if there are many, you are probably mixing rules with test cases.

A practical detail: recent models follow instructions more closely, and that changes style. Anthropic’s guide warns that Claude Opus 4.5 and 4.6 are more responsive to the system prompt than earlier models, and that aggressive wording meant to compensate for inattention (“CRITICAL: You MUST…”) can make the model overuse a tool. Its advice is to soften it and write “use this tool when…”.

What should it not contain?

Secrets. API keys, passwords, sensitive internal data. A user may get the model to reveal the prompt’s content (the technique is called prompt leaking), so do not treat it as a private place.
Data that changes daily. Prices, inventory or policies that are updated should come from a source queried at the moment. See knowledge cutoff.
Contradictory instructions. If two rules clash, the model will choose unpredictably.
Filler. Courtesy phrases or generic warnings that do not change behavior only take space.

Where should each thing live?

Type of information	Where it goes	Why
Role, tone and format	System prompt	Changes rarely and affects every answer
Policy, prices, inventory	Tool or queried source	Changes often and must be exact
User history	Conversation messages, summarized if long	Specific to each session
Keys and credentials	Environment variables or a secrets manager, never the prompt	The model should not be able to read them
Examples of good answers	A few examples in the system prompt or the conversation	They teach the pattern in little space; see few-shot prompting

What about security?

The system prompt is not a security barrier. Indirect prompt injection consists of hiding instructions in external data the application retrieves, such as an email, a web page or a document. The paper by Greshake and colleagues (2023) showed that, in applications that integrate models, an attacker can plant prompts in content the application retrieves later and so alter its behavior or steal data. The authors noted that effective defenses were lacking.

The UK’s National Cyber Security Centre (NCSC) wrote in December 2025 that prompt injection attacks may never be totally mitigated and that the realistic goal is to reduce their likelihood and impact; it also warns against products that claim to “stop” them. Common practice combines several layers: filtering inputs and outputs (see guardrails), giving the agent only minimum permissions, separating external content from instructions and keeping human oversight of sensitive actions. The system prompt helps, but it is not enough.

When NOT to use a long system prompt?

When the product is very simple and one sentence is enough. Also when the rules change depending on the user’s context: in those cases it is better to load specific instructions only when they are needed, rather than one huge prompt that is always sent. Coding assistants do this with per-project instruction files; see CLAUDE.md and AGENTS.md.

Example

Illustrative example: a support assistant for a furniture store has a 1,800-token system prompt that includes return policies, a price table and a list of 40 exceptions. Answers are inconsistent because the exceptions contradict one another. The team rewrites it: the system prompt defines role, tone and format; the policy and prices are fetched with a tool in each case; and the exceptions move to a table reviewed monthly. Cost per conversation drops and answers match the current policy.

Common mistakes

Storing keys or sensitive data in the system prompt.
Trusting the system prompt to prevent every misuse.
Piling up exceptions until they contradict each other.
Copying example prompts without adapting them to the product.
Not versioning the system prompt or recording which version produced each answer; without that you cannot detect prompt regressions when you change a sentence.
Assuming a model change will not affect the prompt: test it against fixed cases before migrating.

Sources

Anthropic, “Prompting best practices” (role in the system prompt; sensitivity to the system prompt in recent models): https://platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices
Anthropic, Messages API reference (system parameter): https://platform.claude.com/docs/en/api/messages
Anthropic, “System prompts” (release notes for the claude.ai and app prompts; they do not apply to the API): https://platform.claude.com/docs/en/release-notes/system-prompts
OpenAI, text generation guide (developer and user roles, instructions parameter): https://developers.openai.com/api/docs/guides/text
Google, Gemini text generation documentation (system_instruction parameter): https://aistudio.google.com/docs/text-generation
NCSC, “Prompt injection is not SQL injection” (December 8, 2025): https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
Greshake et al., “Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection” (arXiv:2302.12173, 2023): https://arxiv.org/abs/2302.12173
Wikipedia, “Prompt injection” (includes prompt leaking): https://en.wikipedia.org/wiki/Prompt_injection

Frequently asked questions

What is a system prompt?

It is the set of instructions the developer sends to the model along with each request to define its role, tone, limits and format. The user usually does not see it.

Can the user read the system prompt?

They can try to make the model reveal it, and sometimes succeed; there are known cases of systems leaking their prompt. That is why it should not contain secrets or data you do not want revealed.

How long should a system prompt be?

As short as the task allows. A long prompt takes space in every request and can dilute the most important instructions.

Does a system prompt protect against prompt injection?

Only partly. It helps, but it is not a sufficient defense: the UK’s NCSC warns that prompt injection may never be fully mitigated. Limit permissions, separate external data from instructions and keep human oversight of sensitive actions.