System Prompt is the developer-authored standing instruction that frames every model turn, sitting at the top of the context window above user and assistant messages to define persona, scope, output format, safety boundaries, and tool-use policy. It is set once per session or per request by the application, not by the end user, and it is treated by most chat APIs as a distinct role (system) rather than as ordinary text. Because it is prepended to every turn, it acts as the highest-leverage control surface for steering model behavior without modifying weights. Modern APIs also let developers pin portions of it as cacheable prefix, so a long system prompt can be paid for once and reused across thousands of turns at a fraction of the input-token cost.
How it works
The system prompt is injected as the first block of the message array passed to the model, typically with a role of system or developer (OpenAI renamed system to developer in early 2025 to signal that it is owned by the app, not the user). Providers apply it with elevated precedence: when a user message conflicts with the system prompt, most aligned models defer to the system prompt, though this precedence is advisory rather than enforced at the decoding level. The prompt is re-sent on every stateless request, so anything not cached is billed and latency-added each turn. Within the prompt, developers layer instructions, examples, tool schemas, and retrieved context, all of which compete for the same context window budget.
Why it matters for AI engineers
The system prompt is where shipping decisions concentrate: persona, refusal policy, output schema, and tool routing all live here, so a single ambiguous clause can cause silent regressions across every user turn. Cost and latency scale with its length unless prompt caching is applied, which makes prefix stability a first-order engineering concern—reordering lines can invalidate the cache and double your input spend. It is also the primary attack surface for prompt injection, since any untrusted text that reaches the context window can attempt to override it, and leakage of the system prompt itself is a recurring disclosure bug in production agents.
System Prompt vs. alternatives
| Control surface | Who sets it | Scope | Persistence |
|---|---|---|---|
| System prompt | Developer / app | Per session or per request | Resent each turn (cacheable) |
| User message | End user | Single turn | One turn |
| Fine-tuning | Developer | Model weights | Permanent across all prompts |
| Guardrails | Platform / policy layer | Post-hoc filter | Independent of model context |
Related terms
Definitions are the start. Ask the Research Desk for a cited, multi-source brief on System Prompt — real sources, verified claims, delivered in minutes.
Ask the Research Desk →