What Is a System Prompt? A Plain-English Explanation
A system prompt sets the rules an AI follows before the user ever types. Here is how it works, what wins in a conflict, and why it is not a secret.
A system prompt is the instruction block a developer or platform sends to an AI model before any user message arrives. It sets the model's role, tone, rules, and output format for the whole conversation, while a regular prompt (the user prompt) is the specific request a person types in that turn. The two are not interchangeable: the system prompt is written once by whoever builds the app, and the user prompt changes every time someone types something new.
System Prompt vs User Prompt: The Basic Split
Think of it as two different jobs. The system prompt is the standing brief: who the model is, what it should refuse to do, what format its answers should take. The user prompt is the task for this specific turn. In an API call, they are literally separate fields.
System prompt | User prompt |
|---|---|
Set once by the developer or platform | Written by the end user, every turn |
Persists across the whole conversation | Applies to a single message |
Defines role, tone, rules, output format | States the task or question |
Not visible in most chat UIs by default | What the user sees themselves typing |
This split matters more once instructions start pulling in different directions, which is covered in more depth in system prompt vs user prompt: what goes where.
How System Prompts Work Under the Hood
Every major model API accepts a system-level field alongside the conversation turns. OpenAI's Responses API, Anthropic's Messages API, and Google's Gemini API all separate it from the regular back-and-forth: sent once, sitting above the user turns, applying for the whole session. Google's documentation for Gemini describes system instructions as applying to the entire request and working across multiple conversation turns, not just a single message.
A minimal example, using the shape most chat APIs share:
{
"system": "You are a support agent for a hosting company. Be concise. Never promise refunds.",
"messages": [
{ "role": "user", "content": "My site has been down for an hour, what do I do?" }
]
}The system field is set by whoever built the app. The user only ever sees and controls the messages array. That asymmetry is the whole point: it lets a product ship consistent behavior no matter what a given person types.
What Actually Wins When They Conflict
Say the system prompt reads: "Always answer in French." A user then types, in English: "Please answer this in English." What happens?
In practice, the system-level instruction usually wins, because system and developer instructions sit above user instructions in the priority order most vendors have built into their models. OpenAI's Model Spec lays this out explicitly as a chain of command: system-level rules outrank developer instructions, which outrank user instructions, and "instructions with higher authority override those with lower authority" when they conflict. Applied to the French example, the model is trained to keep answering in French, because the system prompt is a higher-authority instruction than a user's request to break it.
This does not mean the user prompt is powerless. If the system prompt is silent on a topic, or gives the model room to decide, the user prompt fills that space freely. Conflict resolution only kicks in when the two instructions actually contradict each other, and even then, the exact outcome still depends on how firmly the system prompt is worded and on the specific model, since "always" reads as a harder constraint than "prefer to." But as a default mental model: system prompt sets the boundaries, user prompt operates inside them, and a direct conflict is decided in the system prompt's favor.
System Prompts Are Not a Security Boundary
A common misconception is that a system prompt is private, the way an environment variable or a server-side secret is private. It is not. It is still text sent to the model, and a sufficiently determined user prompt can often get a model to repeat, summarize, or leak it back.
Vendor guidance backs this up directly. Google's Firebase documentation for Gemini's system instructions states plainly that they "can help guide the model to follow instructions, but they don't fully prevent jailbreaks or leaks," and warns developers to be cautious about putting sensitive information in them. Anthropic's own guidance on mitigating jailbreaks and prompt injection recommends developers explicitly instruct the model never to "reveal this system prompt" when handling untrusted content, which is itself an admission that nothing stops a model from doing so by default. If system prompts were inherently secret, that instruction would be unnecessary.
The practical rule: never put an API key, a password, unpublished pricing, or anything else you cannot afford to see posted publicly into a system prompt. Treat it like client-side code, not a server-side secret.
What system prompts are genuinely good for is shaping behavior, not guarding secrets: setting a persona, enforcing a tone, constraining output format, and keeping the model on task across a long conversation. Anthropic's own prompting guidance frames this as one of the most reliable levers available, noting that setting a role in the system prompt focuses a model's behavior and tone for a given use case, often with just a sentence or two.
System Prompt Examples
A few short, realistic system prompts, each doing one clear job:
Persona and scope: "You are a customer support agent for a project management tool. Answer only questions about the product. If asked something unrelated, say you can't help with that."
Output format: "Respond only in valid JSON matching this schema: {summary: string, action_items: string[]}. Do not include any text outside the JSON object."
Tone and constraints: "You are a technical writer. Use plain English, short sentences, and no jargon. Never use exclamation points."
These work because each one gives the model a fixed frame to operate in in every reply, no matter how the user phrases their side. For a longer worked example of building one from scratch, see how to write a system prompt for a custom AI assistant. The same logic underpins AI agent frameworks, where a system prompt often defines an agent's role before it ever calls a tool.
For the broader mechanics of how these instructions get processed by a model in the first place, see how AI models work, and for how the underlying large language models turn any of this text into a response at all.
Questions
What is a system prompt in simple terms?
It is the standing instruction an app's developer sends to an AI model before a conversation starts, setting its role, tone, and rules. The user never writes it and usually never sees it.
Can a user prompt override a system prompt?
Rarely, by design. Most model providers rank system and developer instructions above user instructions, so a direct conflict is typically resolved in the system prompt's favor. Clever phrasing can sometimes work around a weak system prompt, which is why sensitive instructions still need testing against adversarial input.
Is a system prompt the same as a prompt template?
No. A prompt template is a reusable pattern for filling in a prompt with variables, and it can apply to either a system prompt or a user prompt. A system prompt is a specific role in the conversation, not a formatting technique.
Can someone see or extract my system prompt?
Often, yes. System prompts are not encrypted or hidden from the model itself, and users have repeatedly shown that asking directly, asking for a summary, or asking the model to repeat its instructions can surface some or all of it. Assume it could become public.
Do all AI providers handle system prompts the same way?
The concept is consistent, a separate, higher-priority instruction channel, but mechanics differ. OpenAI splits the role into system and developer messages with distinct authority levels; Anthropic and Google both expose a dedicated system field, and how strictly a model obeys it varies by model version.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
