A system prompt is a block of instructions sent to a model ahead of the conversation, setting how it should behave — its role, tone, format, and limits — before it ever sees your question. It travels in a separate slot from your messages, and models are trained to weight it more heavily than ordinary user text.
What goes in one
Usually two layers of actual prompt text, sitting on top of a third thing that is not prompt text at all. The application's instructions — the part an app like this one writes, telling the model what tool it is being used as and how to format a reply. And yours: the standing preferences you set once and expect to apply to every chat. Underneath both is the provider's own safety behaviour, and that is mostly trained into the model rather than prepended as text — worth separating, because a rule learned in training is not sitting in your request and cannot be edited by anything in it.
That last layer is what a custom-instructions feature is. In this app your global instructions, and any project-level instructions, are assembled into the system message that leads each request — so "answer in British English", "I am a nurse, skip the basics", or "always show the reasoning" applies without being retyped. See custom instructions for how that is set up.
Why it is not a security boundary
The APIs do give a system prompt higher standing than user text, and models are trained to follow that ordering. The problem is that the ordering is learned behaviour rather than an enforced rule: it holds most of the time and fails some of the time. Conflicting instructions — especially inside content the model is asked to process, such as a pasted web page or an uploaded document — can and do win. That is the whole mechanism behind prompt injection, and it is why a system prompt should never be treated as an access control. Anything that genuinely must not happen has to be enforced outside the model, in code that does not read text supplied by an attacker.
It is also not secret. Published research has recovered system prompts from production assistants — ChatGPT, Claude, Bing Chat and Bard among them — so a prompt that would be embarrassing if published should be assumed publishable.
The cost nobody mentions
A system prompt is part of the input, so it is counted in the context window and charged on every turn — at a reduced rate where the provider caches an unchanged prefix, but charged. A long, elaborate instruction block is a standing cost on every message in every conversation, and in practice much of its length does no work.
Frequently Asked Questions
- What is the difference between a system prompt and a user prompt?
The user prompt is your actual question, sent in the user role. The system prompt is standing context sent in a separate role that models are trained to prioritise. Both are text in the same request; the difference is how strongly the model is trained to weight them.
- Can I see the system prompt of an AI product?
Not officially, in most cases, though many have been extracted by users and published. The practical takeaway is that a system prompt is a behavioural default, not a confidential asset — assume anything in it could become public.
- Do custom instructions change what the provider stores?
No. They change how the model answers, not what the provider does with the request afterwards. Retention and training are governed by the API mode and the account settings — see zero-retention API and training opt-out.
- Does a longer system prompt make answers better?
Up to a point, then it stops helping and starts costing. How much instruction actually helps depends on the task and the model, but precise, concrete sentences do more per token than general guidance, and every extra token is re-sent on every turn of every conversation.
Related terms: Prompt Injection · Context Window · all glossary terms