System prompt

A system prompt is the standing instruction a business gives an AI assistant before any customer types a word. It says who the assistant is, what it may and may not do, and how it answers, for example: "You answer questions for Bakkerij De Vries about orders, in Dutch, and never promise delivery times." Customers usually don't see it, but it shapes every reply.

What goes into a system prompt?

Mostly the things a new employee would need on day one:

• A role and the business context. Setting a role "focuses Claude's behavior and tone for your use case", Anthropic writes, and even one sentence helps.
• Facts the assistant needs, such as opening hours or the returns policy.
• Rules: which topics it handles, what it must never promise, when it hands over to a person.
• Tone, language and length.
• A few examples of good answers (few-shot prompting). Anthropic recommends three to five.

OpenAI compares it to a function definition: the developer's instructions hold "the system's rules and business logic", and the user's messages are the arguments.

How does it work?

The system prompt is a separate part of each request. In September 2026 Anthropic's Messages API takes it as a system parameter, OpenAI offers an instructions parameter and developer messages, and Google's Gemini API a system_instruction. Chat apps have their own: Anthropic publishes the system prompts of its Claude apps, which give Claude the current date among other things, and notes that they do not apply to the API.

The model reads the system prompt as tokens in its context window, ahead of the conversation and with every request, so a long one is billed every time. Prompt caching helps: in September 2026 Anthropic charges 10% of the normal input price for cached tokens on most models.

Models are trained to rank these instructions above the user's. OpenAI's guide says developer messages are "prioritized ahead of user messages". Wallace et al. (OpenAI, 2024) argued that models often gave system prompts the same priority as user text, and trained GPT-3.5 to rank them higher. Even trained models do not follow that order reliably (see instruction hierarchy).

Where does it go wrong?

• It is not a secret. Zhang, Carlini and Ippolito found that simple text attacks revealed prompts with high probability across 11 models; the 2024 version of their paper adds extractions from Claude 3 and ChatGPT. OWASP (LLM07:2025) says the system prompt "should not be considered a secret, nor should it be used as a security control": keep API keys, passwords, database names and permission rules out of it.
• It is not a lock. A customer, or text the assistant reads, can talk it out of its rules (prompt injection, jailbreaking). OWASP advises enforcing limits such as permissions in systems outside the model, and checking the output with separate guardrails.
• It changes with the model. Even different snapshots of one model can respond differently, OpenAI notes. It advises pinning a model version, testing how the prompt behaves and keeping production prompts in your code.

Example

Suppose a bakery puts an assistant on its website with this system prompt:

1
You are the online assistant of Bakkerij De Vries.
2
You answer questions about our products, opening hours and orders, in the customer's language.
3
Opening hours: Tuesday to Saturday, 7:00 to 17:00. Cakes need two days' notice.
4
You cannot take or change orders: refer customers to the order form.
5
Never promise discounts or delivery times.
6
If a customer is unhappy, or you are not sure, say that a colleague will reply by email.
7
Keep answers short and friendly.

The prompt steers the assistant, and the order system itself still decides what can be ordered and at what price, whatever a customer types in the chat.