Definition
A system prompt (also called a system message) is the top-level instruction supplied to a chat-style language model before the conversation begins. It tells the model who it is, what it can do, how it should sound, and what it must never do. Unlike the back-and-forth user messages that follow, the system prompt is treated as the most authoritative voice in the conversation and shapes every reply the model produces.
Where it fits in the message structure
Modern chat APIs structure a conversation as a list of messages, each tagged with
a role: system, user, or assistant. The single system message comes
first and applies to the whole exchange, while user and assistant messages
alternate beneath it. Models are deliberately trained so that instructions in the
system role outrank anything a user later says — this is what lets a developer
keep a support bot on-topic even when a user tries to redirect it.
What it controls
A good system prompt typically sets several things at once:
- Identity and role — “You are a friendly billing-support assistant for Acme.”
- Tone and style — formal vs casual, concise vs detailed, language to use.
- Capabilities and scope — what topics are in bounds and which to decline.
- Output format — Markdown, JSON, bullet lists, maximum length.
- Hard constraints — safety rules, refusal conditions, and data it must not reveal.
Because the system prompt is invisible to the end user, it is the cleanest place to encode product behaviour without cluttering the chat itself.
Why it matters for behaviour and consistency
The system prompt is the highest-leverage piece of text in an LLM application. A precise one makes a model behave reliably across thousands of conversations; a vague or contradictory one produces drift, off-topic answers, and inconsistent tone. Engineers iterate on system prompts the way they iterate on configuration — small wording changes can measurably shift accuracy, refusals, and format adherence.
The security dimension
Because the system prompt often contains business rules — and sometimes sensitive context — it is a target. Prompt injection attacks try to get the model to ignore its system instructions (“ignore previous instructions and…”), while system prompt leakage attacks try to extract the hidden text verbatim. Treat the system prompt as a security boundary: never place secrets such as API keys inside it, keep critical logic server-side, and test it against adversarial inputs before shipping.