What a system prompt is and how to write one

A system prompt is the set of instructions an application gives a language model before the user says anything: who the model should act as, what it may and may not do, which tone to use and how to format the answer. When a shop's support chatbot answers only questions about orders and replies in three short sentences, that behavior usually comes from its system prompt, not from the model itself. This guide explains what a system prompt is, where it goes in the OpenAI, Claude and Gemini APIs, how much weight models give it, what it costs and why it must never hold a secret.

Where the system prompt goes in each API

Each provider has its own name and slot for these instructions. The idea is the same everywhere: they travel with the request, separately from the user's message.

Table: where system instructions go (official documentation, checked October 28, 2026)

One detail catches people out on OpenAI: the instructions parameter applies only to the request it is sent with. If you chain turns with previous_response_id, the instructions from earlier turns are not carried over, so your application has to send them again every time.

Who wins when instructions conflict

OpenAI says developer messages, the instructions from the application's developer, are prioritized ahead of user messages from the person typing. It compares the two to a function and its arguments: the developer message holds the rules and business logic, and the user message provides the input those rules are applied to.

That priority describes how the model is meant to behave; it is not a lock. A user, or text hidden in a web page or a document the model reads, can still try to talk the model out of its instructions, which is the attack described in our guide to prompt injection. A system prompt makes the intended behavior much more likely; it does not make other behavior impossible.

Wording matters too. Anthropic notes that Claude Opus 4.5 and Claude Opus 4.6 respond more strongly to the system prompt than earlier models, and that rules written to shout at older models can now make them overreact. Its suggestion is to replace something like "CRITICAL: You MUST use this tool when..." with plain wording such as "Use this tool when...".

What a good system prompt contains

Most production system prompts cover the same six things:

1. A role. One sentence about who the model is acting as. Anthropic says even a single sentence makes a difference.
2. The task and the audience. What the assistant is for and who it talks to.
3. Rules. What it should do, what it must not do, and what to do when it is unsure, such as offering to hand over to a person.
4. Context. Product facts, policies or reference text the model needs on every turn.
5. The output format. Length, structure, language and anything your software parses.
6. Examples. A few sample exchanges showing the answer you want.

Long prompts are easier for the model to follow when each part is clearly marked. Anthropic recommends wrapping each type of content in its own XML tag, such as <instructions> or <context>, and says this reduces misinterpretation; Markdown headings do a similar job. Our prompt engineering basics cover how to phrase each instruction.

An example for a support chatbot

Here is a short system prompt for an imaginary online bicycle shop. It is an illustration, not a template that works unchanged everywhere:

You are the customer support assistant for an online bicycle shop.

<rules>
- Answer only questions about orders, delivery, returns and the products in <context>.
- If the answer is not in <context>, say you are not sure and offer to pass the
  conversation to a person.
- Never ask for card numbers or passwords.
- Reply in the customer's language, in three sentences at most.
</rules>

<context>
Delivery: 2 to 4 working days in Spain. Returns: 30 days, free of charge.
</context>

Each line maps to one of the six parts above: the role in the first line, rules in their own block, and the facts the model may use in a separate block. Everything a customer asks is then read in the light of those instructions.

What a system prompt costs

The system prompt is billed as input tokens on every call, because the model has to read it each time. In our worked example of a support chatbot's monthly cost, a 1,200-token system prompt sent on four turns accounts for 4,800 of the 6,500 input tokens in each conversation. A long prompt is not a problem in itself, but every token in it is multiplied by your traffic.

Prompt caching is the usual answer, and the system prompt is the ideal candidate because it repeats exactly. Two rules from the providers decide whether it works:

• Static content goes first. Anthropic builds its cache in a fixed order, tools, then system, then messages, and a change at one level invalidates that level and everything after it. A date, a user's name or anything else that changes at the top of the system prompt breaks the cache for the whole request.
• There is a minimum length. OpenAI caches prompts from 1,024 tokens on GPT-5.6 and later models, and Anthropic from 512 tokens on its 5.5 models. Shorter prompts are simply processed at the normal price.

Our guide to prompt caching explains the discounts, and the context window sets the outer limit on how long the prompt and conversation can grow.

Why a system prompt is not a secret or a lock

OWASP, the open security project, lists system prompt leakage among the main risks of applications built on language models. Its guidance is blunt: the system prompt "should not be considered a secret", and it should not be used as a security control either. Users can often coax a model into revealing its instructions, and nothing guarantees it will refuse.

Three practical consequences follow from OWASP's guidance:

• Keep credentials out. Passwords, API keys and connection strings do not belong in a system prompt.
• Enforce limits in code. Rules such as who may see which data or how much a user may spend must be checked by your software, not left to the model's instructions.
• Check outputs independently. OWASP considers a separate system that inspects the model's output preferable to relying on system prompt instructions alone.

Write every system prompt as if a curious user will read it one day, because one may.

Custom instructions in consumer apps

You do not need an API to use the same idea. In ChatGPT, custom instructions are guidance you write yourself in its Personalization settings, and the assistant takes them into account in your chats; our guide to ChatGPT memory explains how they sit alongside saved memories. The difference with an application's system prompt is who writes it: you, for yourself, instead of a developer, for every user of a product.

How we checked

We read OpenAI's text generation guide and its prompt caching guide, Anthropic's prompting best practices and prompt caching documentation, Google's Gemini text generation documentation and the OWASP entry LLM07:2025 System Prompt Leakage on October 28, 2026. The figure of 4,800 input tokens comes from the example in our chatbot cost guide. The sample system prompt is our own illustration and has not been tested against any particular model.