System prompt

Requests to a model are a list of messages, each labelled with a role. The system message comes first, and models are trained to weight it more heavily than anything a user says afterwards. It stays in context for the whole conversation, so it is re-read on every turn and paid for in tokens on every turn.

In practice it carries the role, the tone, the output format, the boundaries and any facts that should hold across the whole session — the current date, the user tier, which tools exist.

It is where most of the behaviour of an AI feature actually lives. Two products built on the same model differ almost entirely in their system prompt and the context they assemble, which means the highest-leverage editing you can do usually happens in a text file rather than in code.

Because it is re-read every turn, it is also where consistency comes from. Instructions buried in an early user message drift out of relevance as a conversation grows; instructions in the system prompt do not.

Treating it as a security boundary. A system prompt is text, in the same context window as everything else, and a determined user can often talk a model out of it. Anything that genuinely must not happen needs enforcing in code outside the model — never assume that "do not reveal this" holds.

The second is length. A system prompt that has grown to two thousand words of accumulated edge cases usually performs worse than a focused one, because the important instructions are competing with the ones added to fix a bug six months ago.