[UTC+3]
← All articles

What Is a System Prompt, and Why It Decides Everything Before the First Word

July 30, 2026 · 3 minBasicsIn plain words

A system prompt is the instruction a model receives before the user's first word. It never appears in the chat, yet it determines everything: role, tone, the limits of what is permitted. Given the same request — "tell me about the competitors" — an analyst model returns figures, while a marketer model returns positioning and framing. The difference lies in the system prompt.

before
the user's
first message
~70%
of model behaviour
is set by it
~30%
of cases fall
to jailbreak attacks

How does a system prompt work

Technically it is the first block of text to enter the model's context window. It comes before the conversation history and before every user message. The model reads it and shapes its behaviour around it.

A system prompt handles three jobs:

Job Example Without the prompt
Role "You are a financial analyst" The model answers like a generic chatbot
Tone "Answer briefly, no filler" Sprawling answers padded with detail
Limits "Do not give medical advice" The model may offer a dangerous recommendation

What are the four levels of a system prompt

How detailed the prompt needs to be depends on the job. Basic politeness takes one line. A prompt for a support agent takes a paragraph. A prompt for an AI agent that makes decisions takes a page.

The rule of scale

The more the model does on its own, the more detailed the prompt. Two lines are enough for a chatbot. An agent that moves money needs a full page listing forbidden actions — and a test for every prohibition.

When does a system prompt fail to help

A system prompt is a setting, not a defence. Three cases where it is not enough:

  • Jailbreaks. An attacker phrases the request so that the model ignores the prompt. On open models such attacks succeed around 30% of the time. The fix is additional filters at the API level, not a new prompt.
  • Conflicting instructions. A persistent enough user can get the model to switch over to their instruction. This is especially true in long conversations, where the context window dilutes the earlier instructions.
  • Complex scenarios. A system prompt is good at setting the general outline of behaviour, but business logic needs code. An agent that issues invoices should not rely on the prompt alone — every action needs a check at the application level.

How do you write a system prompt that works

Five points that hold up in practice:

  1. State the role in one sentence. "You are a bank support specialist," not a page-long essay.
  2. Make prohibitions more specific than permissions. "Do not name specific amounts" is stronger than "be careful with figures."
  3. Give examples. Two or three samples of a "good" and a "bad" answer work better than long instructions.
  4. Set priorities. What to do when instructions contradict each other: "Safety outranks politeness" is the rule that settles the conflict.
  5. Test for jailbreaks. Five requests along the lines of "forget everything I said earlier" — if the model gives in on three out of five, the prompt needs reinforcing with API-level filters, not more text.

Frequently asked questions

What is a system prompt, in plain words?

It is an instruction the model receives before the user's first message. It never appears in the chat, but it defines the model's role — for example, "answer as a financial analyst" or "do not use emoji."

How does a system prompt differ from an ordinary one?

An ordinary prompt is what the user types into the chat. A system prompt is set once by the developer when the chat is built, and it governs the entire conversation. The user never sees it.

Can a user get around the system prompt?

Yes. A system prompt is a setting, not a defence. Jailbreak attacks get around it in roughly 30% of cases on open models. Critical scenarios call for additional filters.

Let’s discuss your project?

Tell us about your process — we’ll suggest where AI pays off fastest.