Definition
A system prompt is a high-authority instruction layer supplied before the model handles user input. It can establish the model's role, operating rules, available tools, response format, and relevant environment details. In a production agent, this layer may be assembled at runtime from policy, product configuration, tool descriptions, and session state rather than stored as one static block of text.
Role names and authority levels are provider-specific. OpenAI's September 2025 Model Spec, for example, treats system and developer messages as separate levels, with system instructions above developer instructions. Other APIs use different names or expose fewer layers. "Developer instruction" is therefore not a reliable synonym for "system prompt."
There is no well-supported single origin for the term. Its current meaning grew out of instruction-tuned chat interfaces and the message-role conventions used by model APIs.
What it can and cannot enforce
A system prompt strongly influences model behavior, but it remains input to a probabilistic system. It is not a permission check, a sandbox, or a secure place to keep secrets. If violating a rule would expose data, spend money, or change an external system, enforce that rule in code and give the model only the capabilities it is allowed to use.
System prompts also age. As models and tools change, instructions that once improved behavior can become redundant or counterproductive. Anthropic's Boris Cherny described removing large portions of Claude Code's prompt after model upgrades; the durable practice is to run ablations for each release, not to assume that more instructions are always better.
Distinguish it from nearby terms
- A user prompt asks for work within the current interaction. It has lower authority in systems that implement role hierarchies.
- A developer message is a distinct instruction level in OpenAI's current scheme. It should not be assumed to mean the same thing across providers.
- A guardrail is an enforcement mechanism around the model. A system prompt may state a rule, but a guardrail can block the prohibited action.
Check your understanding
An agent's system prompt says it may read files but must never delete them. What control would you add before exposing a filesystem tool?